brakeman 4.8.1 → 4.10.1

data/bundle/ruby/{2.4.0/gems/slim-4.0.1 → 2.7.0/gems/slim-4.1.0}/lib/slim/command.rb

@@ -110,19 +110,19 @@ module Slim
           Template.new(@options[:file]) { @options[:input].read }.render(nil, locals)
         end
 
-      rescue Exception => ex
-        raise ex if @options[:trace] || SystemExit === ex
-        $stderr.print "#{ex.class}: " if ex.class != RuntimeError
-        $stderr.puts ex.message
-        $stderr.puts '  Use --trace for backtrace.'
-        exit 1
-      else
-        unless @options[:output]
-          file = args.shift
-          @options[:output] = file ? File.open(file, 'w') : $stdout
-        end
-        @options[:output].puts(result)
-        exit 0
+    rescue Exception => ex
+      raise ex if @options[:trace] || SystemExit === ex
+      $stderr.print "#{ex.class}: " if ex.class != RuntimeError
+      $stderr.puts ex.message
+      $stderr.puts '  Use --trace for backtrace.'
+      exit 1
+    else
+      unless @options[:output]
+        file = args.shift
+        @options[:output] = file ? File.open(file, 'w') : $stdout
+      end
+      @options[:output].puts(result)
+      exit 0
     end
   end
 end

data/bundle/ruby/{2.4.0/gems/slim-4.0.1 → 2.7.0/gems/slim-4.1.0}/lib/slim/parser.rb

@@ -70,7 +70,7 @@ module Slim
         end
       end
       keys = Regexp.union @attr_shortcut.keys.sort_by {|k| -k.size }
-      @attr_shortcut_re = /\A(#{keys}+)((?:\p{Word}|-)*)/
+      @attr_shortcut_re = /\A(#{keys}+)((?:\p{Word}|-|\/\d+|:(\w|-)+)*)/
       keys = Regexp.union @tag_shortcut.keys.sort_by {|k| -k.size }
       @tag_re = /\A(?:#{keys}|\*(?=[^\s]+)|(\p{Word}(?:\p{Word}|:|-)*\p{Word}|\p{Word}+))/
       keys = Regexp.escape @code_attr_delims.keys.join

data/bundle/ruby/{2.4.0/gems/slim-4.0.1 → 2.7.0/gems/slim-4.1.0}/lib/slim/version.rb

@@ -1,5 +1,5 @@
 module Slim
   # Slim version string
   # @api public
-  VERSION = '4.0.1'
+  VERSION = '4.1.0'
 end

data/lib/brakeman.rb

@@ -20,6 +20,10 @@ module Brakeman
   #option is set
   Errors_Found_Exit_Code = 7
 
+  #Exit code returned when an ignored warning has no note and
+  #--ensure-ignore-notes is set
+  Empty_Ignore_Note_Exit_Code = 8
+
   @debug = false
   @quiet = false
   @loaded_dependencies = []
@@ -233,6 +237,8 @@ module Brakeman
       [:to_table]
     when :junit, :to_junit
       [:to_junit]
+    when :sarif, :to_sarif
+      [:to_sarif]
     else
       [:to_text]
     end
@@ -262,6 +268,8 @@ module Brakeman
         :to_table
       when /\.junit$/i
         :to_junit
+      when /\.sarif$/i
+        :to_sarif
       else
         :to_text
       end
@@ -498,6 +506,18 @@ module Brakeman
     end
   end
 
+  # Returns an array of alert fingerprints for any ignored warnings without
+  # notes found in the specified ignore file (if it exists).
+  def self.ignore_file_entries_with_empty_notes file
+    return [] unless file
+
+    require 'brakeman/report/ignore/config'
+
+    config = IgnoreConfig.new(file, nil)
+    config.read_from_file
+    config.already_ignored_entries_with_empty_notes.map { |i| i[:fingerprint] }
+  end
+
   def self.filter_warnings tracker, options
     require 'brakeman/report/ignore/config'
 

data/lib/brakeman/checks/base_check.rb

@@ -467,7 +467,7 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
   end
 
   def gemfile_or_environment gem_name = :rails
-    if gem_name and info = tracker.config.get_gem(gem_name)
+    if gem_name and info = tracker.config.get_gem(gem_name.to_sym)
       info
     elsif @app_tree.exists?("Gemfile")
       @app_tree.file_path "Gemfile"

data/lib/brakeman/checks/check_basic_auth.rb

@@ -57,6 +57,8 @@ class Brakeman::CheckBasicAuth < Brakeman::BaseCheck
 
   # Check if the block of a result contains a comparison of password to string
   def include_password_literal? result
+    return false if result[:block_args].nil?
+
     @password_var = result[:block_args].last
     @include_password = false
     process result[:block]

data/lib/brakeman/checks/check_csrf_token_forgery_cve.rb

@@ -0,0 +1,28 @@
+require 'brakeman/checks/base_check'
+
+class Brakeman::CheckCSRFTokenForgeryCVE < Brakeman::BaseCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for versions with CSRF token forgery vulnerability (CVE-2020-8166)"
+
+  def run_check
+    fix_version = case
+      when version_between?('0.0.0', '5.2.4.2')
+        '5.2.4.3'
+      when version_between?('6.0.0', '6.0.3')
+        '6.0.3.1'
+      else
+        nil
+      end
+
+    if fix_version
+      warn :warning_type => "Cross-Site Request Forgery",
+        :warning_code => :CVE_2020_8166,
+        :message => msg(msg_version(rails_version), " has a vulnerability that may allow CSRF token forgery. Upgrade to ", msg_version(fix_version), " or patch"),
+        :confidence => :medium,
+        :gem_info => gemfile_or_environment,
+        :link => "https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw"
+    end
+  end
+end
+