brakeman 4.8.0 → 5.2.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (273) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +144 -2
  3. data/README.md +23 -6
  4. data/bundle/load.rb +7 -5
  5. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/CHANGELOG.md +24 -0
  6. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/FAQ.md +0 -0
  7. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/Gemfile +1 -4
  8. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/MIT-LICENSE +0 -0
  9. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/README.md +21 -16
  10. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/REFERENCE.md +39 -10
  11. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/TODO +0 -0
  12. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/haml.gemspec +2 -1
  13. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_builder.rb +58 -3
  14. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_compiler.rb +45 -32
  15. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/attribute_parser.rb +0 -0
  16. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/buffer.rb +0 -56
  17. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/compiler.rb +0 -0
  18. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/engine.rb +0 -0
  19. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/error.rb +0 -0
  20. data/bundle/ruby/2.7.0/gems/haml-5.2.2/lib/haml/escapable.rb +77 -0
  21. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/exec.rb +0 -0
  22. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/filters.rb +0 -0
  23. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/generator.rb +0 -0
  24. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_extensions.rb +0 -0
  25. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_mods.rb +0 -0
  26. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
  27. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/safe_erubi_template.rb +0 -0
  28. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/safe_erubis_template.rb +0 -0
  29. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers/xss_mods.rb +6 -3
  30. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/helpers.rb +7 -1
  31. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/options.rb +0 -0
  32. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/parser.rb +32 -4
  33. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/plugin.rb +18 -1
  34. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/railtie.rb +5 -0
  35. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/sass_rails_filter.rb +0 -0
  36. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/template/options.rb +0 -0
  37. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/template.rb +0 -0
  38. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/temple_engine.rb +2 -1
  39. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/temple_line_counter.rb +0 -0
  40. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/util.rb +1 -1
  41. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml/version.rb +1 -1
  42. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/lib/haml.rb +0 -0
  43. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/yard/default/fulldoc/html/css/common.sass +0 -0
  44. data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.2}/yard/default/layout/html/footer.erb +0 -0
  45. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/MIT-LICENSE.txt +20 -0
  46. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/processor_count.rb +45 -0
  47. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb +4 -0
  48. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel.rb +532 -0
  49. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt +22 -0
  50. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md +178 -0
  51. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md +48 -0
  52. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attlistdecl.rb +63 -0
  53. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attribute.rb +205 -0
  54. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/cdata.rb +68 -0
  55. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/child.rb +97 -0
  56. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/comment.rb +80 -0
  57. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/doctype.rb +311 -0
  58. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/document.rb +451 -0
  59. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/attlistdecl.rb +11 -0
  60. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/dtd.rb +47 -0
  61. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/elementdecl.rb +18 -0
  62. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/entitydecl.rb +57 -0
  63. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/notationdecl.rb +40 -0
  64. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/element.rb +2599 -0
  65. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/encoding.rb +51 -0
  66. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/entity.rb +171 -0
  67. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/default.rb +116 -0
  68. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/pretty.rb +142 -0
  69. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/transitive.rb +58 -0
  70. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/functions.rb +447 -0
  71. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/instruction.rb +79 -0
  72. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/light/node.rb +188 -0
  73. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/namespace.rb +59 -0
  74. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/node.rb +76 -0
  75. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/output.rb +30 -0
  76. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parent.rb +166 -0
  77. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parseexception.rb +52 -0
  78. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb +694 -0
  79. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/lightparser.rb +59 -0
  80. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb +197 -0
  81. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb +273 -0
  82. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/streamparser.rb +61 -0
  83. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb +101 -0
  84. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/ultralightparser.rb +57 -0
  85. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/xpathparser.rb +689 -0
  86. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/quickpath.rb +266 -0
  87. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/rexml.rb +37 -0
  88. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/sax2listener.rb +98 -0
  89. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/security.rb +28 -0
  90. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/source.rb +298 -0
  91. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/streamlistener.rb +93 -0
  92. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/text.rb +424 -0
  93. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/undefinednamespaceexception.rb +9 -0
  94. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/relaxng.rb +539 -0
  95. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validation.rb +144 -0
  96. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validationexception.rb +10 -0
  97. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmldecl.rb +130 -0
  98. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmltokens.rb +85 -0
  99. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath.rb +81 -0
  100. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath_parser.rb +974 -0
  101. data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml.rb +3 -0
  102. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/History.rdoc +148 -0
  103. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/Manifest.txt +7 -0
  104. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/README.rdoc +1 -0
  105. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/compare/normalize.rb +51 -6
  106. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/debugging.md +190 -0
  107. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/gauntlet.md +106 -0
  108. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/rp_extensions.rb +15 -36
  109. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/rp_stringscanner.rb +33 -0
  110. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.rb +7128 -0
  111. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby20_parser.y +420 -296
  112. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.rb +7182 -0
  113. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby21_parser.y +415 -293
  114. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.rb +7228 -0
  115. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby22_parser.y +419 -295
  116. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.rb +7237 -0
  117. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby23_parser.y +419 -295
  118. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.rb +7268 -0
  119. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby24_parser.y +419 -295
  120. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.rb +7268 -0
  121. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby26_parser.y → ruby_parser-3.18.1/lib/ruby25_parser.y} +418 -308
  122. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.rb +7287 -0
  123. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby_parser.yy → ruby_parser-3.18.1/lib/ruby26_parser.y} +419 -399
  124. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.rb +8517 -0
  125. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby25_parser.y → ruby_parser-3.18.1/lib/ruby27_parser.y} +1030 -294
  126. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.rb +8751 -0
  127. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.y +3472 -0
  128. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby3_parser.yy +3476 -0
  129. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rb +308 -605
  130. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rex +33 -27
  131. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_lexer.rex.rb +65 -31
  132. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer_strings.rb +638 -0
  133. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_parser.rb +4 -0
  134. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_parser.yy +3487 -0
  135. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/lib/ruby_parser_extras.rb +341 -127
  136. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/tools/munge.rb +43 -10
  137. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.18.1}/tools/ripper.rb +15 -10
  138. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/History.rdoc +39 -0
  139. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/Manifest.txt +0 -0
  140. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/README.rdoc +0 -0
  141. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/composite_sexp_processor.rb +0 -0
  142. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/pt_testcase.rb +9 -4
  143. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp.rb +19 -9
  144. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp_matcher.rb +4 -7
  145. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/sexp_processor.rb +1 -1
  146. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/strict_sexp.rb +25 -3
  147. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.14.1 → sexp_processor-4.16.0}/lib/unique.rb +0 -0
  148. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/CHANGES +4 -0
  149. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/Gemfile +12 -13
  150. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/LICENSE +0 -0
  151. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/README.jp.md +0 -0
  152. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/README.md +0 -0
  153. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/code_attributes.rb +0 -0
  154. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/command.rb +13 -13
  155. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/controls.rb +0 -0
  156. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/do_inserter.rb +0 -0
  157. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/embedded.rb +0 -0
  158. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/end_inserter.rb +0 -0
  159. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/engine.rb +0 -0
  160. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/erb_converter.rb +0 -0
  161. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/filter.rb +0 -0
  162. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/grammar.rb +0 -0
  163. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/include.rb +0 -0
  164. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/interpolation.rb +0 -0
  165. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less/context.rb +0 -0
  166. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less/filter.rb +0 -0
  167. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/logic_less.rb +0 -0
  168. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/parser.rb +1 -1
  169. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/escaper.rb +0 -0
  170. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/filter.rb +0 -0
  171. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart/parser.rb +0 -0
  172. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/smart.rb +0 -0
  173. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/splat/builder.rb +0 -0
  174. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/splat/filter.rb +0 -0
  175. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/template.rb +0 -0
  176. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/translator.rb +0 -0
  177. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim/version.rb +1 -1
  178. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/lib/slim.rb +0 -0
  179. data/bundle/ruby/2.7.0/gems/{slim-4.0.1 → slim-4.1.0}/slim.gemspec +0 -0
  180. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/CHANGELOG.md +8 -0
  181. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/MIT-LICENSE.txt +0 -0
  182. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/README.md +1 -1
  183. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/data/display_width.marshal.gz +0 -0
  184. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/constants.rb +2 -2
  185. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/index.rb +0 -0
  186. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/no_string_ext.rb +0 -0
  187. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width/string_ext.rb +0 -0
  188. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.6.1 → unicode-display_width-1.8.0}/lib/unicode/display_width.rb +0 -0
  189. data/lib/brakeman/app_tree.rb +37 -4
  190. data/lib/brakeman/checks/base_check.rb +18 -2
  191. data/lib/brakeman/checks/check_basic_auth.rb +2 -0
  192. data/lib/brakeman/checks/check_csrf_token_forgery_cve.rb +28 -0
  193. data/lib/brakeman/checks/check_deserialize.rb +21 -1
  194. data/lib/brakeman/checks/check_detailed_exceptions.rb +1 -1
  195. data/lib/brakeman/checks/check_eol_rails.rb +23 -0
  196. data/lib/brakeman/checks/check_eol_ruby.rb +26 -0
  197. data/lib/brakeman/checks/check_evaluation.rb +1 -1
  198. data/lib/brakeman/checks/check_execute.rb +12 -1
  199. data/lib/brakeman/checks/check_json_entity_escape.rb +38 -0
  200. data/lib/brakeman/checks/check_json_parsing.rb +1 -1
  201. data/lib/brakeman/checks/check_mass_assignment.rb +37 -9
  202. data/lib/brakeman/checks/check_model_attr_accessible.rb +1 -1
  203. data/lib/brakeman/checks/check_model_attributes.rb +1 -1
  204. data/lib/brakeman/checks/check_page_caching_cve.rb +37 -0
  205. data/lib/brakeman/checks/check_permit_attributes.rb +1 -1
  206. data/lib/brakeman/checks/check_regex_dos.rb +1 -1
  207. data/lib/brakeman/checks/check_render.rb +15 -1
  208. data/lib/brakeman/checks/check_sanitize_methods.rb +2 -1
  209. data/lib/brakeman/checks/check_skip_before_filter.rb +4 -4
  210. data/lib/brakeman/checks/check_sql.rb +60 -9
  211. data/lib/brakeman/checks/check_symbol_dos.rb +1 -1
  212. data/lib/brakeman/checks/check_template_injection.rb +32 -0
  213. data/lib/brakeman/checks/check_unsafe_reflection_methods.rb +68 -0
  214. data/lib/brakeman/checks/check_verb_confusion.rb +75 -0
  215. data/lib/brakeman/checks/eol_check.rb +47 -0
  216. data/lib/brakeman/commandline.rb +25 -1
  217. data/lib/brakeman/file_parser.rb +58 -22
  218. data/lib/brakeman/options.rb +39 -2
  219. data/lib/brakeman/parsers/template_parser.rb +26 -3
  220. data/lib/brakeman/processors/alias_processor.rb +132 -24
  221. data/lib/brakeman/processors/base_processor.rb +4 -4
  222. data/lib/brakeman/processors/controller_alias_processor.rb +6 -43
  223. data/lib/brakeman/processors/controller_processor.rb +1 -1
  224. data/lib/brakeman/processors/gem_processor.rb +3 -0
  225. data/lib/brakeman/processors/haml_template_processor.rb +17 -1
  226. data/lib/brakeman/processors/lib/call_conversion_helper.rb +13 -7
  227. data/lib/brakeman/processors/lib/file_type_detector.rb +64 -0
  228. data/lib/brakeman/processors/lib/find_all_calls.rb +28 -13
  229. data/lib/brakeman/processors/lib/rails3_config_processor.rb +16 -16
  230. data/lib/brakeman/processors/lib/rails3_route_processor.rb +2 -0
  231. data/lib/brakeman/processors/lib/rails4_config_processor.rb +2 -1
  232. data/lib/brakeman/processors/lib/render_helper.rb +3 -1
  233. data/lib/brakeman/processors/library_processor.rb +9 -0
  234. data/lib/brakeman/processors/model_processor.rb +32 -0
  235. data/lib/brakeman/processors/output_processor.rb +1 -1
  236. data/lib/brakeman/processors/template_alias_processor.rb +5 -0
  237. data/lib/brakeman/report/ignore/config.rb +5 -1
  238. data/lib/brakeman/report/ignore/interactive.rb +1 -1
  239. data/lib/brakeman/report/report_base.rb +0 -2
  240. data/lib/brakeman/report/report_csv.rb +37 -60
  241. data/lib/brakeman/report/report_github.rb +31 -0
  242. data/lib/brakeman/report/report_junit.rb +2 -2
  243. data/lib/brakeman/report/report_sarif.rb +133 -0
  244. data/lib/brakeman/report/report_sonar.rb +38 -0
  245. data/lib/brakeman/report/report_tabs.rb +1 -1
  246. data/lib/brakeman/report/report_text.rb +38 -17
  247. data/lib/brakeman/report.rb +19 -1
  248. data/lib/brakeman/rescanner.rb +7 -5
  249. data/lib/brakeman/scanner.rb +65 -31
  250. data/lib/brakeman/tracker/collection.rb +57 -7
  251. data/lib/brakeman/tracker/config.rb +87 -5
  252. data/lib/brakeman/tracker/constants.rb +8 -7
  253. data/lib/brakeman/tracker/controller.rb +1 -1
  254. data/lib/brakeman/tracker/method_info.rb +70 -0
  255. data/lib/brakeman/tracker.rb +42 -5
  256. data/lib/brakeman/util.rb +58 -21
  257. data/lib/brakeman/version.rb +1 -1
  258. data/lib/brakeman/warning.rb +10 -2
  259. data/lib/brakeman/warning_codes.rb +13 -0
  260. data/lib/brakeman.rb +45 -6
  261. data/lib/ruby_parser/bm_sexp.rb +33 -9
  262. metadata +201 -123
  263. data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb +0 -50
  264. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/debugging.md +0 -18
  265. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/rp_stringscanner.rb +0 -64
  266. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby20_parser.rb +0 -7042
  267. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby21_parser.rb +0 -7113
  268. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby22_parser.rb +0 -7146
  269. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby23_parser.rb +0 -7163
  270. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby24_parser.rb +0 -7175
  271. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby25_parser.rb +0 -7175
  272. data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby26_parser.rb +0 -7195
  273. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.6.1/data/display_width.marshal.gz +0 -0
@@ -92,7 +92,7 @@ class Brakeman::Report::Text < Brakeman::Report::Base
92
92
  HighLine.color("No warnings found", :bold, :green)
93
93
  else
94
94
  warnings = tracker.filtered_warnings.sort_by do |w|
95
- [w.confidence, w.warning_type, w.file, w.line, w.fingerprint]
95
+ [w.confidence, w.warning_type, w.file, w.line || 0, w.fingerprint]
96
96
  end.map do |w|
97
97
  output_warning w
98
98
  end
@@ -145,24 +145,45 @@ class Brakeman::Report::Text < Brakeman::Report::Base
145
145
  end
146
146
 
147
147
  def output_warning w
148
- out = [
149
- label('Confidence', confidence(w.confidence)),
150
- label('Category', w.warning_type.to_s),
151
- label('Check', w.check.gsub(/^Brakeman::Check/, '')),
148
+ text_format = tracker.options[:text_fields] ||
149
+ [:confidence, :category, :check, :message, :code, :file, :line]
150
+
151
+ text_format.map do |option|
152
+ format_line(w, option)
153
+ end.compact
154
+ end
155
+
156
+ def format_line w, option
157
+ case option
158
+ when :confidence
159
+ label('Confidence', confidence(w.confidence))
160
+ when :category
161
+ label('Category', w.warning_type.to_s)
162
+ when :check
163
+ label('Check', w.check_name)
164
+ when :message
152
165
  label('Message', w.message)
153
- ]
154
-
155
- if w.code
156
- out << label('Code', format_code(w))
157
- end
158
-
159
- out << label('File', warning_file(w))
160
-
161
- if w.line
162
- out << label('Line', w.line)
166
+ when :code
167
+ if w.code
168
+ label('Code', format_code(w))
169
+ end
170
+ when :file
171
+ label('File', warning_file(w))
172
+ when :line
173
+ if w.line
174
+ label('Line', w.line)
175
+ end
176
+ when :link
177
+ label('Link', w.link)
178
+ when :fingerprint
179
+ label('Fingerprint', w.fingerprint)
180
+ when :category_id
181
+ label('Category ID', w.warning_code)
182
+ when :render_path
183
+ if w.called_from
184
+ label('Render Path', w.called_from.join(" > "))
185
+ end
163
186
  end
164
-
165
- out
166
187
  end
167
188
 
168
189
  def double_space title, values
@@ -6,7 +6,7 @@ require 'brakeman/report/report_base'
6
6
  class Brakeman::Report
7
7
  attr_reader :tracker
8
8
 
9
- VALID_FORMATS = [:to_html, :to_pdf, :to_csv, :to_json, :to_tabs, :to_hash, :to_s, :to_markdown, :to_codeclimate, :to_plain, :to_text, :to_junit]
9
+ VALID_FORMATS = [:to_html, :to_pdf, :to_csv, :to_json, :to_tabs, :to_hash, :to_s, :to_markdown, :to_codeclimate, :to_plain, :to_text, :to_junit, :to_github]
10
10
 
11
11
  def initialize tracker
12
12
  @app_tree = tracker.app_tree
@@ -43,6 +43,14 @@ class Brakeman::Report
43
43
  when :to_junit
44
44
  require_report 'junit'
45
45
  Brakeman::Report::JUnit
46
+ when :to_sarif
47
+ return self.to_sarif
48
+ when :to_sonar
49
+ require_report 'sonar'
50
+ Brakeman::Report::Sonar
51
+ when :to_github
52
+ require_report 'github'
53
+ Brakeman::Report::Github
46
54
  else
47
55
  raise "Invalid format: #{format}. Should be one of #{VALID_FORMATS.inspect}"
48
56
  end
@@ -67,6 +75,11 @@ class Brakeman::Report
67
75
  generate Brakeman::Report::JSON
68
76
  end
69
77
 
78
+ def to_sonar
79
+ require_report 'sonar'
80
+ generate Brakeman::Report::Sonar
81
+ end
82
+
70
83
  def to_table
71
84
  require_report 'table'
72
85
  generate Brakeman::Report::Table
@@ -85,6 +98,11 @@ class Brakeman::Report
85
98
  alias to_plain to_text
86
99
  alias to_s to_text
87
100
 
101
+ def to_sarif
102
+ require_report 'sarif'
103
+ generate Brakeman::Report::SARIF
104
+ end
105
+
88
106
  def generate reporter
89
107
  reporter.new(@tracker).generate_report
90
108
  end
@@ -132,10 +132,11 @@ class Brakeman::Rescanner < Brakeman::Scanner
132
132
  template_name = template_path_to_name(path)
133
133
 
134
134
  tracker.reset_template template_name
135
- fp = Brakeman::FileParser.new(tracker)
135
+ fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
136
136
  template_parser = Brakeman::TemplateParser.new(tracker, fp)
137
137
  template_parser.parse_template path, path.read
138
- process_template fp.file_list[:templates].first
138
+ tracker.add_errors(fp.errors)
139
+ process_template fp.file_list.first
139
140
 
140
141
  @processor.process_template_alias tracker.templates[template_name]
141
142
 
@@ -390,9 +391,10 @@ class Brakeman::Rescanner < Brakeman::Scanner
390
391
 
391
392
  def parse_ruby_files list
392
393
  paths = list.select(&:exists?)
393
- file_parser = Brakeman::FileParser.new(tracker)
394
- file_parser.parse_files paths, :rescan
395
- file_parser.file_list[:rescan]
394
+ file_parser = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout], tracker.options[:parallel_checks])
395
+ file_parser.parse_files paths
396
+ tracker.add_errors(file_parser.errors)
397
+ file_parser.file_list
396
398
  end
397
399
  end
398
400
 
@@ -7,6 +7,7 @@ begin
7
7
  require 'brakeman/app_tree'
8
8
  require 'brakeman/file_parser'
9
9
  require 'brakeman/parsers/template_parser'
10
+ require 'brakeman/processors/lib/file_type_detector'
10
11
  rescue LoadError => e
11
12
  $stderr.puts e.message
12
13
  $stderr.puts "Please install the appropriate dependency."
@@ -23,7 +24,10 @@ class Brakeman::Scanner
23
24
  @app_tree = Brakeman::AppTree.from_options(options)
24
25
 
25
26
  if (!@app_tree.root || !@app_tree.exists?("app")) && !options[:force_scan]
26
- raise Brakeman::NoApplication, "Please supply the path to a Rails application (looking in #{@app_tree.root})."
27
+ message = "Please supply the path to a Rails application (looking in #{@app_tree.root}).\n" <<
28
+ " Use `--force` to run a scan anyway."
29
+
30
+ raise Brakeman::NoApplication, message
27
31
  end
28
32
 
29
33
  @processor = processor || Brakeman::Processor.new(@app_tree, options)
@@ -36,69 +40,92 @@ class Brakeman::Scanner
36
40
 
37
41
  #Process everything in the Rails application
38
42
  def process
39
- Brakeman.notify "Processing gems..."
43
+ Brakeman.notify "Processing gems... "
40
44
  process_gems
41
45
  guess_rails_version
42
- Brakeman.notify "Processing configuration..."
46
+ Brakeman.notify "Processing configuration... "
43
47
  process_config
44
- Brakeman.notify "Parsing files..."
48
+ Brakeman.notify "Parsing files... "
45
49
  parse_files
46
- Brakeman.notify "Processing initializers..."
50
+ Brakeman.notify "Detecting file types... "
51
+ detect_file_types
52
+ Brakeman.notify "Processing initializers... "
47
53
  process_initializers
48
- Brakeman.notify "Processing libs..."
54
+ Brakeman.notify "Processing libs... "
49
55
  process_libs
50
- Brakeman.notify "Processing routes... "
56
+ Brakeman.notify "Processing routes... "
51
57
  process_routes
52
- Brakeman.notify "Processing templates... "
58
+ Brakeman.notify "Processing templates... "
53
59
  process_templates
54
- Brakeman.notify "Processing data flow in templates..."
60
+ Brakeman.notify "Processing data flow in templates... "
55
61
  process_template_data_flows
56
- Brakeman.notify "Processing models... "
62
+ Brakeman.notify "Processing models... "
57
63
  process_models
58
- Brakeman.notify "Processing controllers... "
64
+ Brakeman.notify "Processing controllers... "
59
65
  process_controllers
60
66
  Brakeman.notify "Processing data flow in controllers..."
61
67
  process_controller_data_flows
62
- Brakeman.notify "Indexing call sites... "
68
+ Brakeman.notify "Indexing call sites... "
63
69
  index_call_sites
64
70
  tracker
65
71
  end
66
72
 
67
73
  def parse_files
68
- fp = Brakeman::FileParser.new tracker
74
+ fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout], tracker.options[:parallel_checks])
69
75
 
70
- files = {
71
- :initializers => @app_tree.initializer_paths,
72
- :controllers => @app_tree.controller_paths,
73
- :models => @app_tree.model_paths
74
- }
75
-
76
- unless options[:skip_libs]
77
- files[:libs] = @app_tree.lib_paths
78
- end
79
-
80
- files.each do |name, paths|
81
- fp.parse_files paths, name
82
- end
76
+ fp.parse_files tracker.app_tree.ruby_file_paths
83
77
 
84
78
  template_parser = Brakeman::TemplateParser.new(tracker, fp)
85
79
 
86
- fp.read_files(@app_tree.template_paths, :templates) do |path, contents|
80
+ fp.read_files(@app_tree.template_paths) do |path, contents|
87
81
  template_parser.parse_template path, contents
88
82
  end
89
83
 
90
- @file_list = fp.file_list
84
+ # Collect errors raised during parsing
85
+ tracker.add_errors(fp.errors)
86
+
87
+ @parsed_files = fp.file_list
88
+ end
89
+
90
+ def detect_file_types
91
+ @file_list = {
92
+ controllers: [],
93
+ initializers: [],
94
+ libs: [],
95
+ models: [],
96
+ templates: [],
97
+ }
98
+
99
+ detector = Brakeman::FileTypeDetector.new
100
+
101
+ @parsed_files.each do |file|
102
+ if file.is_a? Brakeman::TemplateParser::TemplateFile
103
+ @file_list[:templates] << file
104
+ else
105
+ type = detector.detect_type(file)
106
+ unless type == :skip
107
+ if @file_list[type].nil?
108
+ raise type.to_s
109
+ else
110
+ @file_list[type] << file
111
+ end
112
+ end
113
+ end
114
+ end
91
115
  end
92
116
 
93
117
  #Process config/environment.rb and config/gems.rb
94
118
  #
95
119
  #Stores parsed information in tracker.config
96
120
  def process_config
121
+ # Sometimes folks like to put constants in environment.rb
122
+ # so let's always process it even for newer Rails versions
123
+ process_config_file "environment.rb"
124
+
97
125
  if options[:rails3] or options[:rails4] or options[:rails5] or options[:rails6]
98
126
  process_config_file "application.rb"
99
127
  process_config_file "environments/production.rb"
100
128
  else
101
- process_config_file "environment.rb"
102
129
  process_config_file "gems.rb"
103
130
  end
104
131
 
@@ -110,8 +137,12 @@ class Brakeman::Scanner
110
137
  end
111
138
 
112
139
  if @app_tree.exists? ".ruby-version"
113
- tracker.config.set_ruby_version @app_tree.file_path(".ruby-version").read
140
+ if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/]
141
+ tracker.config.set_ruby_version version
142
+ end
114
143
  end
144
+
145
+ tracker.config.load_rails_defaults
115
146
  end
116
147
 
117
148
  def process_config_file file
@@ -322,8 +353,11 @@ class Brakeman::Scanner
322
353
  end
323
354
 
324
355
  def parse_ruby_file file
325
- fp = Brakeman::FileParser.new(self.tracker)
356
+ fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
326
357
  fp.parse_ruby(file.read, file)
358
+ rescue Exception => e
359
+ tracker.error(e)
360
+ nil
327
361
  end
328
362
  end
329
363
 
@@ -1,4 +1,5 @@
1
1
  require 'brakeman/util'
2
+ require 'brakeman/tracker/method_info'
2
3
 
3
4
  module Brakeman
4
5
  class Collection
@@ -13,6 +14,8 @@ module Brakeman
13
14
  @src = {}
14
15
  @includes = []
15
16
  @methods = { :public => {}, :private => {}, :protected => {} }
17
+ @class_methods = {}
18
+ @simple_methods = { :class => {}, instance: {} }
16
19
  @options = {}
17
20
  @tracker = tracker
18
21
 
@@ -22,7 +25,7 @@ module Brakeman
22
25
  def ancestor? parent, seen={}
23
26
  seen[self.name] = true
24
27
 
25
- if self.parent == parent or seen[self.parent]
28
+ if self.parent == parent or self.name == parent or seen[self.parent]
26
29
  true
27
30
  elsif parent_model = collection[self.parent]
28
31
  parent_model.ancestor? parent, seen
@@ -37,7 +40,7 @@ module Brakeman
37
40
  end
38
41
 
39
42
  def add_include class_name
40
- @includes << class_name
43
+ @includes << class_name unless ancestor?(class_name)
41
44
  end
42
45
 
43
46
  def add_option name, exp
@@ -46,11 +49,17 @@ module Brakeman
46
49
  end
47
50
 
48
51
  def add_method visibility, name, src, file_name
52
+ meth_info = Brakeman::MethodInfo.new(name, src, self, file_name)
53
+ add_simple_method_maybe meth_info
54
+
49
55
  if src.node_type == :defs
56
+ @class_methods[name] = meth_info
57
+
58
+ # TODO fix this weirdness
50
59
  name = :"#{src[1]}.#{name}"
51
60
  end
52
61
 
53
- @methods[visibility][name] = { :src => src, :file => file_name }
62
+ @methods[visibility][name] = meth_info
54
63
  end
55
64
 
56
65
  def each_method
@@ -61,16 +70,31 @@ module Brakeman
61
70
  end
62
71
  end
63
72
 
64
- def get_method name
65
- each_method do |n, info|
66
- if n == name
67
- return info
73
+ def get_method name, type = :instance
74
+ case type
75
+ when :class
76
+ get_class_method name
77
+ when :instance
78
+ get_instance_method name
79
+ else
80
+ raise "Unexpected method type: #{type.inspect}"
81
+ end
82
+ end
83
+
84
+ def get_instance_method name
85
+ @methods.each do |_vis, meths|
86
+ if meths[name]
87
+ return meths[name]
68
88
  end
69
89
  end
70
90
 
71
91
  nil
72
92
  end
73
93
 
94
+ def get_class_method name
95
+ @class_methods[name]
96
+ end
97
+
74
98
  def file
75
99
  @files.first
76
100
  end
@@ -90,5 +114,31 @@ module Brakeman
90
114
  def methods_public
91
115
  @methods[:public]
92
116
  end
117
+
118
+ def get_simple_method_return_value type, name
119
+ @simple_methods[type][name]
120
+ end
121
+
122
+ private
123
+
124
+ def add_simple_method_maybe meth_info
125
+ if meth_info.very_simple_method?
126
+ add_simple_method meth_info
127
+ end
128
+ end
129
+
130
+ def add_simple_method meth_info
131
+ name = meth_info.name
132
+ value = meth_info.return_value
133
+
134
+ case meth_info.src.node_type
135
+ when :defn
136
+ @simple_methods[:instance][name] = value
137
+ when :defs
138
+ @simple_methods[:class][name] = value
139
+ else
140
+ raise "Expected sexp type: #{src.node_type}"
141
+ end
142
+ end
93
143
  end
94
144
  end
@@ -14,7 +14,7 @@ module Brakeman
14
14
  @settings = {}
15
15
  @escape_html = nil
16
16
  @erubis = nil
17
- @ruby_version = ""
17
+ @ruby_version = nil
18
18
  @rails_version = nil
19
19
  end
20
20
 
@@ -54,7 +54,7 @@ module Brakeman
54
54
  end
55
55
 
56
56
  def gem_version name
57
- extract_version @gems.dig(name, :version)
57
+ extract_version @gems.dig(name.to_sym, :version)
58
58
  end
59
59
 
60
60
  def add_gem name, version, file, line
@@ -67,11 +67,11 @@ module Brakeman
67
67
  end
68
68
 
69
69
  def has_gem? name
70
- !!@gems[name]
70
+ !!@gems[name.to_sym]
71
71
  end
72
72
 
73
73
  def get_gem name
74
- @gems[name]
74
+ @gems[name.to_sym]
75
75
  end
76
76
 
77
77
  def set_rails_version version = nil
@@ -79,7 +79,9 @@ module Brakeman
79
79
  # Only used by Rails2ConfigProcessor right now
80
80
  extract_version(version)
81
81
  else
82
- gem_version(:rails) || gem_version(:railties)
82
+ gem_version(:rails) ||
83
+ gem_version(:railties) ||
84
+ gem_version(:activerecord)
83
85
  end
84
86
 
85
87
  if version
@@ -104,6 +106,13 @@ module Brakeman
104
106
  tracker.options[:rails5] = true
105
107
  tracker.options[:rails6] = true
106
108
  Brakeman.notify "[Notice] Detected Rails 6 application"
109
+ elsif @rails_version.start_with? "7"
110
+ tracker.options[:rails3] = true
111
+ tracker.options[:rails4] = true
112
+ tracker.options[:rails5] = true
113
+ tracker.options[:rails6] = true
114
+ tracker.options[:rails7] = true
115
+ Brakeman.notify "[Notice] Detected Rails 7 application"
107
116
  end
108
117
  end
109
118
  end
@@ -147,5 +156,78 @@ module Brakeman
147
156
  def session_settings
148
157
  @rails.dig(:action_controller, :session)
149
158
  end
159
+
160
+
161
+ # Set Rails config option value
162
+ # where path is an array of attributes, e.g.
163
+ #
164
+ # :action_controller, :perform_caching
165
+ #
166
+ # then this will set
167
+ #
168
+ # rails[:action_controller][:perform_caching] = value
169
+ def set_rails_config value, *path
170
+ config = self.rails
171
+
172
+ path[0..-2].each do |o|
173
+ config[o] ||= {}
174
+
175
+ option = config[o]
176
+
177
+ if not option.is_a? Hash
178
+ Brakeman.debug "[Notice] Skipping config setting: #{path.map(&:to_s).join(".")}"
179
+ return
180
+ end
181
+
182
+ config = option
183
+ end
184
+
185
+ config[path.last] = value
186
+ end
187
+
188
+ # Load defaults based on config.load_defaults value
189
+ # as documented here: https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults
190
+ def load_rails_defaults
191
+ return unless number? tracker.config.rails[:load_defaults]
192
+
193
+ version = tracker.config.rails[:load_defaults].value
194
+ true_value = Sexp.new(:true)
195
+ false_value = Sexp.new(:false)
196
+
197
+ if version >= 5.0
198
+ set_rails_config(true_value, :action_controller, :per_form_csrf_tokens)
199
+ set_rails_config(true_value, :action_controller, :forgery_protection_origin_check)
200
+ set_rails_config(true_value, :active_record, :belongs_to_required_by_default)
201
+ # Note: this may need to be changed, because ssl_options is a Hash
202
+ set_rails_config(true_value, :ssl_options, :hsts, :subdomains)
203
+ end
204
+
205
+ if version >= 5.1
206
+ set_rails_config(false_value, :assets, :unknown_asset_fallback)
207
+ set_rails_config(true_value, :action_view, :form_with_generates_remote_forms)
208
+ end
209
+
210
+ if version >= 5.2
211
+ set_rails_config(true_value, :active_record, :cache_versioning)
212
+ set_rails_config(true_value, :action_dispatch, :use_authenticated_cookie_encryption)
213
+ set_rails_config(true_value, :active_support, :use_authenticated_message_encryption)
214
+ set_rails_config(true_value, :active_support, :use_sha1_digests)
215
+ set_rails_config(true_value, :action_controller, :default_protect_from_forgery)
216
+ set_rails_config(true_value, :action_view, :form_with_generates_ids)
217
+ end
218
+
219
+ if version >= 6.0
220
+ set_rails_config(Sexp.new(:lit, :zeitwerk), :autoloader)
221
+ set_rails_config(false_value, :action_view, :default_enforce_utf8)
222
+ set_rails_config(true_value, :action_dispatch, :use_cookies_with_metadata)
223
+ set_rails_config(false_value, :action_dispatch, :return_only_media_type_on_content_type)
224
+ set_rails_config(Sexp.new(:str, 'ActionMailer::MailDeliveryJob'), :action_mailer, :delivery_job)
225
+ set_rails_config(true_value, :active_job, :return_false_on_aborted_enqueue)
226
+ set_rails_config(Sexp.new(:lit, :active_storage_analysis), :active_storage, :queues, :analysis)
227
+ set_rails_config(Sexp.new(:lit, :active_storage_purge), :active_storage, :queues, :purge)
228
+ set_rails_config(true_value, :active_storage, :replace_on_assign_to_many)
229
+ set_rails_config(true_value, :active_record, :collection_cache_versioning)
230
+ end
231
+ end
150
232
  end
151
233
  end
@@ -1,7 +1,10 @@
1
1
  require 'brakeman/processors/output_processor'
2
+ require 'brakeman/util'
2
3
 
3
4
  module Brakeman
4
5
  class Constant
6
+ include Brakeman::Util
7
+
5
8
  attr_reader :name, :name_array, :file, :value, :context
6
9
 
7
10
  def initialize name, value, context = {}
@@ -107,13 +110,11 @@ module Brakeman
107
110
  @constants[base_name] << Constant.new(name, value, context)
108
111
  end
109
112
 
110
- LITERALS = [:lit, :false, :str, :true, :array, :hash]
111
- def literal? exp
112
- exp.is_a? Sexp and LITERALS.include? exp.node_type
113
- end
114
-
115
- def get_literal name
116
- if x = self[name] and literal? x
113
+ # Returns constant values that are not too complicated.
114
+ # Right now that means literal values (string, array, etc.)
115
+ # or calls on Dir.glob(..).whatever.
116
+ def get_simple_value name
117
+ if x = self[name] and (literal? x or dir_glob? x)
117
118
  x
118
119
  else
119
120
  nil
@@ -125,7 +125,7 @@ module Brakeman
125
125
  value = args[-1][2]
126
126
  case value.node_type
127
127
  when :array
128
- filter[option] = value[1..-1].map {|v| v[1] }
128
+ filter[option] = value.sexp_body.map {|v| v[1] }
129
129
  when :lit, :str
130
130
  filter[option] = value[1]
131
131
  else
@@ -0,0 +1,70 @@
1
+ require 'brakeman/util'
2
+
3
+ module Brakeman
4
+ class MethodInfo
5
+ include Brakeman::Util
6
+
7
+ attr_reader :name, :src, :owner, :file, :type
8
+
9
+ def initialize name, src, owner, file
10
+ @name = name
11
+ @src = src
12
+ @owner = owner
13
+ @file = file
14
+ @type = case src.node_type
15
+ when :defn
16
+ :instance
17
+ when :defs
18
+ :class
19
+ else
20
+ raise "Expected sexp type: #{src.node_type}"
21
+ end
22
+
23
+ @simple_method = nil
24
+ end
25
+
26
+ # To support legacy code that expected a Hash
27
+ def [] attr
28
+ self.send(attr)
29
+ end
30
+
31
+ def very_simple_method?
32
+ return @simple_method == :very unless @simple_method.nil?
33
+
34
+ # Very simple methods have one (simple) expression in the body and
35
+ # no arguments
36
+ if src.formal_args.length == 1 # no args
37
+ if src.method_length == 1 # Single expression in body
38
+ value = first_body # First expression in body
39
+
40
+ if simple_literal? value or
41
+ (array? value and all_literals? value) or
42
+ (hash? value and all_literals? value, :hash)
43
+
44
+ @return_value = value
45
+ @simple_method = :very
46
+ end
47
+ end
48
+ end
49
+
50
+ @simple_method ||= false
51
+ end
52
+
53
+ def return_value env = nil
54
+ if very_simple_method?
55
+ return @return_value
56
+ else
57
+ nil
58
+ end
59
+ end
60
+
61
+ def first_body
62
+ case @type
63
+ when :class
64
+ src[4]
65
+ when :instance
66
+ src[3]
67
+ end
68
+ end
69
+ end
70
+ end