brakeman 4.9.0 → 5.0.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGES.md +44 -0
- data/README.md +1 -1
- data/bundle/load.rb +4 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/CHANGELOG.md +16 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/FAQ.md +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/Gemfile +1 -4
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/MIT-LICENSE +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/README.md +2 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/REFERENCE.md +29 -7
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/TODO +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/haml.gemspec +2 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_builder.rb +3 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_compiler.rb +42 -31
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_parser.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/buffer.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/compiler.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/engine.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/error.rb +0 -0
- data/bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/escapable.rb +77 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/exec.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/filters.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/generator.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers.rb +7 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_extensions.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_mods.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubi_template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubis_template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/xss_mods.rb +6 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/options.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/parser.rb +32 -4
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/plugin.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/railtie.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/sass_rails_filter.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template/options.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_engine.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_line_counter.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/util.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/version.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/fulldoc/html/css/common.sass +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/layout/html/footer.erb +0 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/Gemfile +6 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/LICENSE.txt +22 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/NEWS.md +141 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/README.md +60 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attlistdecl.rb +63 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attribute.rb +205 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/cdata.rb +68 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/child.rb +97 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/comment.rb +80 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/doctype.rb +287 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/document.rb +291 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/attlistdecl.rb +11 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/dtd.rb +47 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/elementdecl.rb +18 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/entitydecl.rb +57 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/notationdecl.rb +40 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/element.rb +1269 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/encoding.rb +51 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/entity.rb +171 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/default.rb +116 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/pretty.rb +142 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/transitive.rb +58 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/functions.rb +447 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/instruction.rb +79 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/light/node.rb +196 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/namespace.rb +59 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/node.rb +76 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/output.rb +30 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parent.rb +166 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parseexception.rb +52 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/baseparser.rb +594 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/lightparser.rb +59 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/pullparser.rb +197 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/sax2parser.rb +273 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/streamparser.rb +61 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/treeparser.rb +101 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/ultralightparser.rb +57 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/xpathparser.rb +675 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/quickpath.rb +266 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/rexml.rb +32 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/sax2listener.rb +98 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/security.rb +28 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/source.rb +298 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/streamlistener.rb +93 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/text.rb +424 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/undefinednamespaceexception.rb +9 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/relaxng.rb +539 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validation.rb +144 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validationexception.rb +10 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmldecl.rb +130 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmltokens.rb +85 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath.rb +81 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath_parser.rb +968 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.4/rexml.gemspec +84 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/History.rdoc +41 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/Manifest.txt +2 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/README.rdoc +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/compare/normalize.rb +43 -3
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/debugging.md +57 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/rp_extensions.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/rp_stringscanner.rb +0 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby20_parser.rb +7062 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby20_parser.y +91 -58
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby21_parser.rb +2603 -2576
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby21_parser.y +91 -58
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.rb +7160 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby22_parser.y +91 -58
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby23_parser.rb +7175 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby23_parser.y +91 -58
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby24_parser.rb +7204 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby24_parser.y +91 -58
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby23_parser.rb → ruby_parser-3.15.1/lib/ruby25_parser.rb} +2867 -2826
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby25_parser.y +91 -58
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby25_parser.rb → ruby_parser-3.15.1/lib/ruby26_parser.rb} +2432 -2383
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby26_parser.y +91 -58
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2/lib/ruby24_parser.rb → ruby_parser-3.15.1/lib/ruby27_parser.rb} +2432 -2383
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.y +2657 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby_lexer.rb +72 -40
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby_lexer.rex +5 -6
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby_lexer.rex.rb +6 -8
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby_parser.rb +2 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby_parser.yy +93 -58
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/lib/ruby_parser_extras.rb +49 -16
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/tools/munge.rb +9 -4
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.14.2 → ruby_parser-3.15.1}/tools/ripper.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/History.rdoc +12 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/Manifest.txt +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/README.rdoc +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/lib/composite_sexp_processor.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/lib/pt_testcase.rb +2 -2
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/lib/sexp.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/lib/sexp_matcher.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/lib/sexp_processor.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/lib/strict_sexp.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.0 → sexp_processor-4.15.2}/lib/unique.rb +0 -0
- data/lib/brakeman.rb +10 -0
- data/lib/brakeman/app_tree.rb +36 -3
- data/lib/brakeman/checks/base_check.rb +7 -1
- data/lib/brakeman/checks/check_execute.rb +2 -1
- data/lib/brakeman/checks/check_model_attributes.rb +1 -1
- data/lib/brakeman/checks/check_regex_dos.rb +1 -1
- data/lib/brakeman/checks/check_sql.rb +2 -2
- data/lib/brakeman/checks/check_unsafe_reflection_methods.rb +68 -0
- data/lib/brakeman/checks/check_verb_confusion.rb +75 -0
- data/lib/brakeman/file_parser.rb +24 -18
- data/lib/brakeman/options.rb +5 -1
- data/lib/brakeman/parsers/template_parser.rb +2 -3
- data/lib/brakeman/processors/alias_processor.rb +20 -4
- data/lib/brakeman/processors/controller_processor.rb +1 -1
- data/lib/brakeman/processors/haml_template_processor.rb +8 -1
- data/lib/brakeman/processors/lib/call_conversion_helper.rb +1 -1
- data/lib/brakeman/processors/lib/file_type_detector.rb +64 -0
- data/lib/brakeman/processors/lib/rails3_config_processor.rb +16 -16
- data/lib/brakeman/processors/output_processor.rb +1 -1
- data/lib/brakeman/processors/template_alias_processor.rb +5 -0
- data/lib/brakeman/report.rb +15 -0
- data/lib/brakeman/report/report_base.rb +0 -2
- data/lib/brakeman/report/report_csv.rb +37 -60
- data/lib/brakeman/report/report_junit.rb +2 -2
- data/lib/brakeman/report/report_sarif.rb +114 -0
- data/lib/brakeman/report/report_sonar.rb +38 -0
- data/lib/brakeman/report/report_tabs.rb +1 -1
- data/lib/brakeman/report/report_text.rb +1 -1
- data/lib/brakeman/rescanner.rb +7 -5
- data/lib/brakeman/scanner.rb +44 -18
- data/lib/brakeman/tracker.rb +6 -0
- data/lib/brakeman/tracker/config.rb +76 -1
- data/lib/brakeman/tracker/controller.rb +1 -1
- data/lib/brakeman/util.rb +9 -4
- data/lib/brakeman/version.rb +1 -1
- data/lib/brakeman/warning.rb +10 -2
- data/lib/brakeman/warning_codes.rb +2 -0
- data/lib/ruby_parser/bm_sexp.rb +9 -9
- metadata +143 -82
- data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb +0 -50
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/debugging.md +0 -18
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby20_parser.rb +0 -7042
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby22_parser.rb +0 -7146
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.14.2/lib/ruby26_parser.rb +0 -7195
data/lib/brakeman/tracker.rb
CHANGED
@@ -79,7 +79,9 @@ module Brakeman
|
|
79
79
|
# Only used by Rails2ConfigProcessor right now
|
80
80
|
extract_version(version)
|
81
81
|
else
|
82
|
-
gem_version(:rails) ||
|
82
|
+
gem_version(:rails) ||
|
83
|
+
gem_version(:railties) ||
|
84
|
+
gem_version(:activerecord)
|
83
85
|
end
|
84
86
|
|
85
87
|
if version
|
@@ -147,5 +149,78 @@ module Brakeman
|
|
147
149
|
def session_settings
|
148
150
|
@rails.dig(:action_controller, :session)
|
149
151
|
end
|
152
|
+
|
153
|
+
|
154
|
+
# Set Rails config option value
|
155
|
+
# where path is an array of attributes, e.g.
|
156
|
+
#
|
157
|
+
# :action_controller, :perform_caching
|
158
|
+
#
|
159
|
+
# then this will set
|
160
|
+
#
|
161
|
+
# rails[:action_controller][:perform_caching] = value
|
162
|
+
def set_rails_config value, *path
|
163
|
+
config = self.rails
|
164
|
+
|
165
|
+
path[0..-2].each do |o|
|
166
|
+
config[o] ||= {}
|
167
|
+
|
168
|
+
option = config[o]
|
169
|
+
|
170
|
+
if not option.is_a? Hash
|
171
|
+
Brakeman.debug "[Notice] Skipping config setting: #{path.map(&:to_s).join(".")}"
|
172
|
+
return
|
173
|
+
end
|
174
|
+
|
175
|
+
config = option
|
176
|
+
end
|
177
|
+
|
178
|
+
config[path.last] = value
|
179
|
+
end
|
180
|
+
|
181
|
+
# Load defaults based on config.load_defaults value
|
182
|
+
# as documented here: https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults
|
183
|
+
def load_rails_defaults
|
184
|
+
return unless number? tracker.config.rails[:load_defaults]
|
185
|
+
|
186
|
+
version = tracker.config.rails[:load_defaults].value
|
187
|
+
true_value = Sexp.new(:true)
|
188
|
+
false_value = Sexp.new(:false)
|
189
|
+
|
190
|
+
if version >= 5.0
|
191
|
+
set_rails_config(true_value, :action_controller, :per_form_csrf_tokens)
|
192
|
+
set_rails_config(true_value, :action_controller, :forgery_protection_origin_check)
|
193
|
+
set_rails_config(true_value, :active_record, :belongs_to_required_by_default)
|
194
|
+
# Note: this may need to be changed, because ssl_options is a Hash
|
195
|
+
set_rails_config(true_value, :ssl_options, :hsts, :subdomains)
|
196
|
+
end
|
197
|
+
|
198
|
+
if version >= 5.1
|
199
|
+
set_rails_config(false_value, :assets, :unknown_asset_fallback)
|
200
|
+
set_rails_config(true_value, :action_view, :form_with_generates_remote_forms)
|
201
|
+
end
|
202
|
+
|
203
|
+
if version >= 5.2
|
204
|
+
set_rails_config(true_value, :active_record, :cache_versioning)
|
205
|
+
set_rails_config(true_value, :action_dispatch, :use_authenticated_cookie_encryption)
|
206
|
+
set_rails_config(true_value, :active_support, :use_authenticated_message_encryption)
|
207
|
+
set_rails_config(true_value, :active_support, :use_sha1_digests)
|
208
|
+
set_rails_config(true_value, :action_controller, :default_protect_from_forgery)
|
209
|
+
set_rails_config(true_value, :action_view, :form_with_generates_ids)
|
210
|
+
end
|
211
|
+
|
212
|
+
if version >= 6.0
|
213
|
+
set_rails_config(Sexp.new(:lit, :zeitwerk), :autoloader)
|
214
|
+
set_rails_config(false_value, :action_view, :default_enforce_utf8)
|
215
|
+
set_rails_config(true_value, :action_dispatch, :use_cookies_with_metadata)
|
216
|
+
set_rails_config(false_value, :action_dispatch, :return_only_media_type_on_content_type)
|
217
|
+
set_rails_config(Sexp.new(:str, 'ActionMailer::MailDeliveryJob'), :action_mailer, :delivery_job)
|
218
|
+
set_rails_config(true_value, :active_job, :return_false_on_aborted_enqueue)
|
219
|
+
set_rails_config(Sexp.new(:lit, :active_storage_analysis), :active_storage, :queues, :analysis)
|
220
|
+
set_rails_config(Sexp.new(:lit, :active_storage_purge), :active_storage, :queues, :purge)
|
221
|
+
set_rails_config(true_value, :active_storage, :replace_on_assign_to_many)
|
222
|
+
set_rails_config(true_value, :active_record, :collection_cache_versioning)
|
223
|
+
end
|
224
|
+
end
|
150
225
|
end
|
151
226
|
end
|
data/lib/brakeman/util.rb
CHANGED
@@ -321,7 +321,7 @@ module Brakeman::Util
|
|
321
321
|
if node_type? current, :class
|
322
322
|
return true
|
323
323
|
elsif sexp? current
|
324
|
-
todo = current
|
324
|
+
todo = current.sexp_body.concat todo
|
325
325
|
end
|
326
326
|
end
|
327
327
|
|
@@ -334,7 +334,7 @@ module Brakeman::Util
|
|
334
334
|
if args.empty? or args.first.empty?
|
335
335
|
#nothing to do
|
336
336
|
elsif node_type? args.first, :arglist
|
337
|
-
call.concat args.first
|
337
|
+
call.concat args.first.sexp_body
|
338
338
|
elsif args.first.node_type.is_a? Sexp #just a list of args
|
339
339
|
call.concat args.first
|
340
340
|
else
|
@@ -368,8 +368,13 @@ module Brakeman::Util
|
|
368
368
|
#
|
369
369
|
# views/test/something.html.erb -> test/something
|
370
370
|
def template_path_to_name path
|
371
|
-
names = path.relative.split(
|
371
|
+
names = path.relative.split('/')
|
372
372
|
names.last.gsub!(/(\.(html|js)\..*|\.(rhtml|haml|erb|slim))$/, '')
|
373
|
-
|
373
|
+
|
374
|
+
if names.include? 'views'
|
375
|
+
names[(names.index('views') + 1)..-1]
|
376
|
+
else
|
377
|
+
names
|
378
|
+
end.join('/').to_sym
|
374
379
|
end
|
375
380
|
end
|
data/lib/brakeman/version.rb
CHANGED
data/lib/brakeman/warning.rb
CHANGED
@@ -275,6 +275,14 @@ class Brakeman::Warning
|
|
275
275
|
self.file.relative
|
276
276
|
end
|
277
277
|
|
278
|
+
def check_name
|
279
|
+
@check_name ||= self.check.sub(/^Brakeman::Check/, '')
|
280
|
+
end
|
281
|
+
|
282
|
+
def confidence_name
|
283
|
+
TEXT_CONFIDENCE[self.confidence]
|
284
|
+
end
|
285
|
+
|
278
286
|
def to_hash absolute_paths: true
|
279
287
|
if self.called_from and not absolute_paths
|
280
288
|
render_path = self.called_from.with_relative_paths
|
@@ -285,7 +293,7 @@ class Brakeman::Warning
|
|
285
293
|
{ :warning_type => self.warning_type,
|
286
294
|
:warning_code => @warning_code,
|
287
295
|
:fingerprint => self.fingerprint,
|
288
|
-
:check_name => self.
|
296
|
+
:check_name => self.check_name,
|
289
297
|
:message => self.message.to_s,
|
290
298
|
:file => (absolute_paths ? self.file.absolute : self.file.relative),
|
291
299
|
:line => self.line,
|
@@ -294,7 +302,7 @@ class Brakeman::Warning
|
|
294
302
|
:render_path => render_path,
|
295
303
|
:location => self.location(false),
|
296
304
|
:user_input => (@user_input && self.format_user_input(false)),
|
297
|
-
:confidence =>
|
305
|
+
:confidence => self.confidence_name
|
298
306
|
}
|
299
307
|
end
|
300
308
|
|
data/lib/ruby_parser/bm_sexp.rb
CHANGED
@@ -175,7 +175,7 @@ class Sexp
|
|
175
175
|
start_index = 3
|
176
176
|
|
177
177
|
if exp.is_a? Sexp and exp.node_type == :arglist
|
178
|
-
exp = exp
|
178
|
+
exp = exp.sexp_body
|
179
179
|
end
|
180
180
|
|
181
181
|
exp.each_with_index do |e, i|
|
@@ -198,10 +198,10 @@ class Sexp
|
|
198
198
|
|
199
199
|
case self.node_type
|
200
200
|
when :call, :attrasgn, :safe_call, :safe_attrasgn
|
201
|
-
self
|
201
|
+
self.sexp_body(3).unshift :arglist
|
202
202
|
when :super, :zsuper
|
203
203
|
if self[1]
|
204
|
-
self
|
204
|
+
self.sexp_body.unshift :arglist
|
205
205
|
else
|
206
206
|
Sexp.new(:arglist)
|
207
207
|
end
|
@@ -218,13 +218,13 @@ class Sexp
|
|
218
218
|
case self.node_type
|
219
219
|
when :call, :attrasgn, :safe_call, :safe_attrasgn
|
220
220
|
if self[3]
|
221
|
-
self
|
221
|
+
self.sexp_body(3)
|
222
222
|
else
|
223
223
|
Sexp.new
|
224
224
|
end
|
225
225
|
when :super, :zsuper
|
226
226
|
if self[1]
|
227
|
-
self
|
227
|
+
self.sexp_body
|
228
228
|
else
|
229
229
|
Sexp.new
|
230
230
|
end
|
@@ -512,7 +512,7 @@ class Sexp
|
|
512
512
|
self.slice!(index..-1) #Remove old body
|
513
513
|
|
514
514
|
if exp.first == :rlist
|
515
|
-
exp = exp
|
515
|
+
exp = exp.sexp_body
|
516
516
|
end
|
517
517
|
|
518
518
|
#Insert new body
|
@@ -529,11 +529,11 @@ class Sexp
|
|
529
529
|
|
530
530
|
case self.node_type
|
531
531
|
when :defn, :class
|
532
|
-
self
|
532
|
+
self.sexp_body(3)
|
533
533
|
when :defs
|
534
|
-
self
|
534
|
+
self.sexp_body(4)
|
535
535
|
when :module
|
536
|
-
self
|
536
|
+
self.sexp_body(2)
|
537
537
|
end
|
538
538
|
end
|
539
539
|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: brakeman
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version:
|
4
|
+
version: 5.0.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Justin Collins
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2021-01-27 00:00:00.000000000 Z
|
12
12
|
dependencies: []
|
13
13
|
description: Brakeman detects security vulnerabilities in Ruby on Rails applications
|
14
14
|
via static analysis.
|
@@ -56,46 +56,46 @@ files:
|
|
56
56
|
- bundle/ruby/2.7.0/gems/erubis-2.7.0/lib/erubis/tiny.rb
|
57
57
|
- bundle/ruby/2.7.0/gems/erubis-2.7.0/lib/erubis/util.rb
|
58
58
|
- bundle/ruby/2.7.0/gems/erubis-2.7.0/setup.rb
|
59
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
60
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
61
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
62
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
63
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
64
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
65
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
66
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
67
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
68
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
69
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
70
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
71
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
72
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
73
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
74
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
75
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
76
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
77
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
78
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
79
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
80
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
81
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
82
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
83
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
84
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
85
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
86
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
87
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
88
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
89
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
90
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
91
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
92
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
93
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
94
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
95
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
96
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
97
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
98
|
-
- bundle/ruby/2.7.0/gems/haml-5.1
|
59
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/CHANGELOG.md
|
60
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/FAQ.md
|
61
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/Gemfile
|
62
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/MIT-LICENSE
|
63
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/README.md
|
64
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/REFERENCE.md
|
65
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/TODO
|
66
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/haml.gemspec
|
67
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml.rb
|
68
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/attribute_builder.rb
|
69
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/attribute_compiler.rb
|
70
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/attribute_parser.rb
|
71
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/buffer.rb
|
72
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/compiler.rb
|
73
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/engine.rb
|
74
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/error.rb
|
75
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/escapable.rb
|
76
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/exec.rb
|
77
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/filters.rb
|
78
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/generator.rb
|
79
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/helpers.rb
|
80
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/helpers/action_view_extensions.rb
|
81
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/helpers/action_view_mods.rb
|
82
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/helpers/action_view_xss_mods.rb
|
83
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/helpers/safe_erubi_template.rb
|
84
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/helpers/safe_erubis_template.rb
|
85
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/helpers/xss_mods.rb
|
86
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/options.rb
|
87
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/parser.rb
|
88
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/plugin.rb
|
89
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/railtie.rb
|
90
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/sass_rails_filter.rb
|
91
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/template.rb
|
92
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/template/options.rb
|
93
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/temple_engine.rb
|
94
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/temple_line_counter.rb
|
95
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/util.rb
|
96
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/version.rb
|
97
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/yard/default/fulldoc/html/css/common.sass
|
98
|
+
- bundle/ruby/2.7.0/gems/haml-5.2.1/yard/default/layout/html/footer.erb
|
99
99
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/AUTHORS
|
100
100
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/COPYING
|
101
101
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/Changelog.md
|
@@ -132,39 +132,95 @@ files:
|
|
132
132
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/terminal/unix_stty.rb
|
133
133
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/version.rb
|
134
134
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/wrapper.rb
|
135
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/Gemfile
|
136
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/LICENSE.txt
|
137
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/NEWS.md
|
138
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/README.md
|
139
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attlistdecl.rb
|
140
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attribute.rb
|
141
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/cdata.rb
|
142
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/child.rb
|
143
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/comment.rb
|
144
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/doctype.rb
|
145
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/document.rb
|
146
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/attlistdecl.rb
|
147
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/dtd.rb
|
148
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/elementdecl.rb
|
149
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/entitydecl.rb
|
150
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/notationdecl.rb
|
151
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/element.rb
|
152
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/encoding.rb
|
153
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/entity.rb
|
154
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/default.rb
|
155
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/pretty.rb
|
156
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/transitive.rb
|
157
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/functions.rb
|
158
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/instruction.rb
|
159
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/light/node.rb
|
160
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/namespace.rb
|
161
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/node.rb
|
162
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/output.rb
|
163
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parent.rb
|
164
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parseexception.rb
|
165
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/baseparser.rb
|
166
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/lightparser.rb
|
167
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/pullparser.rb
|
168
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/sax2parser.rb
|
169
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/streamparser.rb
|
170
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/treeparser.rb
|
171
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/ultralightparser.rb
|
172
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/xpathparser.rb
|
173
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/quickpath.rb
|
174
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/rexml.rb
|
175
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/sax2listener.rb
|
176
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/security.rb
|
177
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/source.rb
|
178
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/streamlistener.rb
|
179
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/text.rb
|
180
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/undefinednamespaceexception.rb
|
181
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/relaxng.rb
|
182
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validation.rb
|
183
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validationexception.rb
|
184
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmldecl.rb
|
185
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmltokens.rb
|
186
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath.rb
|
187
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath_parser.rb
|
188
|
+
- bundle/ruby/2.7.0/gems/rexml-3.2.4/rexml.gemspec
|
135
189
|
- bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/History.rdoc
|
136
190
|
- bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/Manifest.txt
|
137
191
|
- bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/README.rdoc
|
138
192
|
- bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib/ruby2ruby.rb
|
139
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
140
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
141
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
142
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
143
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
144
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
145
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
146
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
147
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
148
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
149
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
150
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
151
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
152
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
153
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
154
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
155
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
156
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
157
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
158
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
159
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
160
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
161
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
162
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
163
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
164
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
165
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
166
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
167
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
193
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/History.rdoc
|
194
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/Manifest.txt
|
195
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/README.rdoc
|
196
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/compare/normalize.rb
|
197
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/debugging.md
|
198
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/rp_extensions.rb
|
199
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/rp_stringscanner.rb
|
200
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby20_parser.rb
|
201
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby20_parser.y
|
202
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby21_parser.rb
|
203
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby21_parser.y
|
204
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.rb
|
205
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.y
|
206
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby23_parser.rb
|
207
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby23_parser.y
|
208
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby24_parser.rb
|
209
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby24_parser.y
|
210
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby25_parser.rb
|
211
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby25_parser.y
|
212
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby26_parser.rb
|
213
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby26_parser.y
|
214
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.rb
|
215
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.y
|
216
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rb
|
217
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rex
|
218
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rex.rb
|
219
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser.rb
|
220
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser.yy
|
221
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser_extras.rb
|
222
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/tools/munge.rb
|
223
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/tools/ripper.rb
|
168
224
|
- bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/History.rdoc
|
169
225
|
- bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/Manifest.txt
|
170
226
|
- bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/README.rdoc
|
@@ -209,16 +265,16 @@ files:
|
|
209
265
|
- bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib/safe_yaml/version.rb
|
210
266
|
- bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/run_specs_all_ruby_versions.sh
|
211
267
|
- bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/safe_yaml.gemspec
|
212
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
213
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
214
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
215
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
216
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
217
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
218
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
219
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
220
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
221
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.
|
268
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/History.rdoc
|
269
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/Manifest.txt
|
270
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/README.rdoc
|
271
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/composite_sexp_processor.rb
|
272
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/pt_testcase.rb
|
273
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp.rb
|
274
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp_matcher.rb
|
275
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp_processor.rb
|
276
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/strict_sexp.rb
|
277
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/unique.rb
|
222
278
|
- bundle/ruby/2.7.0/gems/slim-4.1.0/CHANGES
|
223
279
|
- bundle/ruby/2.7.0/gems/slim-4.1.0/Gemfile
|
224
280
|
- bundle/ruby/2.7.0/gems/slim-4.1.0/LICENSE
|
@@ -446,8 +502,10 @@ files:
|
|
446
502
|
- lib/brakeman/checks/check_template_injection.rb
|
447
503
|
- lib/brakeman/checks/check_translate_bug.rb
|
448
504
|
- lib/brakeman/checks/check_unsafe_reflection.rb
|
505
|
+
- lib/brakeman/checks/check_unsafe_reflection_methods.rb
|
449
506
|
- lib/brakeman/checks/check_unscoped_find.rb
|
450
507
|
- lib/brakeman/checks/check_validation_regex.rb
|
508
|
+
- lib/brakeman/checks/check_verb_confusion.rb
|
451
509
|
- lib/brakeman/checks/check_weak_hash.rb
|
452
510
|
- lib/brakeman/checks/check_without_protection.rb
|
453
511
|
- lib/brakeman/checks/check_xml_dos.rb
|
@@ -478,6 +536,7 @@ files:
|
|
478
536
|
- lib/brakeman/processors/haml_template_processor.rb
|
479
537
|
- lib/brakeman/processors/lib/basic_processor.rb
|
480
538
|
- lib/brakeman/processors/lib/call_conversion_helper.rb
|
539
|
+
- lib/brakeman/processors/lib/file_type_detector.rb
|
481
540
|
- lib/brakeman/processors/lib/find_all_calls.rb
|
482
541
|
- lib/brakeman/processors/lib/find_call.rb
|
483
542
|
- lib/brakeman/processors/lib/find_return_value.rb
|
@@ -513,6 +572,8 @@ files:
|
|
513
572
|
- lib/brakeman/report/report_json.rb
|
514
573
|
- lib/brakeman/report/report_junit.rb
|
515
574
|
- lib/brakeman/report/report_markdown.rb
|
575
|
+
- lib/brakeman/report/report_sarif.rb
|
576
|
+
- lib/brakeman/report/report_sonar.rb
|
516
577
|
- lib/brakeman/report/report_table.rb
|
517
578
|
- lib/brakeman/report/report_tabs.rb
|
518
579
|
- lib/brakeman/report/report_text.rb
|
@@ -562,7 +623,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
562
623
|
requirements:
|
563
624
|
- - ">="
|
564
625
|
- !ruby/object:Gem::Version
|
565
|
-
version: 2.
|
626
|
+
version: 2.4.0
|
566
627
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
567
628
|
requirements:
|
568
629
|
- - ">="
|