brakeman 4.9.1 → 5.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGES.md +46 -0
- data/README.md +11 -2
- data/bundle/load.rb +4 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/CHANGELOG.md +16 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/FAQ.md +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/Gemfile +1 -4
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/MIT-LICENSE +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/README.md +2 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/REFERENCE.md +29 -7
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/TODO +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/haml.gemspec +2 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_builder.rb +3 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_compiler.rb +42 -31
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/attribute_parser.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/buffer.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/compiler.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/engine.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/error.rb +0 -0
- data/bundle/ruby/2.7.0/gems/haml-5.2.1/lib/haml/escapable.rb +77 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/exec.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/filters.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/generator.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers.rb +7 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_extensions.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_mods.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubi_template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/safe_erubis_template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/helpers/xss_mods.rb +6 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/options.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/parser.rb +32 -4
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/plugin.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/railtie.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/sass_rails_filter.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/template/options.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_engine.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/temple_line_counter.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/util.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/lib/haml/version.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/fulldoc/html/css/common.sass +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.1.2 → haml-5.2.1}/yard/default/layout/html/footer.erb +0 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt +22 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md +178 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md +48 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml.rb +3 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attlistdecl.rb +63 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attribute.rb +205 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/cdata.rb +68 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/child.rb +97 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/comment.rb +80 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/doctype.rb +311 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/document.rb +451 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/attlistdecl.rb +11 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/dtd.rb +47 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/elementdecl.rb +18 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/entitydecl.rb +57 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/notationdecl.rb +40 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/element.rb +2599 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/encoding.rb +51 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/entity.rb +171 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/default.rb +116 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/pretty.rb +142 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/transitive.rb +58 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/functions.rb +447 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/instruction.rb +79 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/light/node.rb +188 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/namespace.rb +59 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/node.rb +76 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/output.rb +30 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parent.rb +166 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parseexception.rb +52 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb +694 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/lightparser.rb +59 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb +197 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb +273 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/streamparser.rb +61 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb +101 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/ultralightparser.rb +57 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/xpathparser.rb +689 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/quickpath.rb +266 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/rexml.rb +37 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/sax2listener.rb +98 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/security.rb +28 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/source.rb +298 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/streamlistener.rb +93 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/text.rb +424 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/undefinednamespaceexception.rb +9 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/relaxng.rb +539 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validation.rb +144 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validationexception.rb +10 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmldecl.rb +130 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmltokens.rb +85 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath.rb +81 -0
- data/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath_parser.rb +974 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/History.rdoc +6 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/Manifest.txt +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/README.rdoc +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/compare/normalize.rb +0 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/debugging.md +190 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/rp_extensions.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/rp_stringscanner.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby20_parser.rb +2550 -2537
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby20_parser.y +9 -1
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby21_parser.rb +7148 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby21_parser.y +9 -1
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.rb +7185 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby22_parser.y +9 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby23_parser.rb +2585 -2561
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby23_parser.y +9 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby24_parser.rb +2622 -2607
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby24_parser.y +9 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby25_parser.rb +2612 -2598
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby25_parser.y +9 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby26_parser.rb +2610 -2594
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby26_parser.y +10 -1
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.rb +7358 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby27_parser.y +47 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby_lexer.rb +19 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby_lexer.rex +1 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby_lexer.rex.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby_parser.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby_parser.yy +55 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/lib/ruby_parser_extras.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/tools/munge.rb +2 -2
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.15.0 → ruby_parser-3.15.1}/tools/ripper.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/History.rdoc +6 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/Manifest.txt +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/README.rdoc +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/composite_sexp_processor.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/pt_testcase.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/sexp.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/sexp_matcher.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/sexp_processor.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/strict_sexp.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/unique.rb +0 -0
- data/lib/brakeman.rb +21 -4
- data/lib/brakeman/app_tree.rb +36 -3
- data/lib/brakeman/checks/base_check.rb +7 -1
- data/lib/brakeman/checks/check_execute.rb +2 -1
- data/lib/brakeman/checks/check_mass_assignment.rb +4 -6
- data/lib/brakeman/checks/check_regex_dos.rb +1 -1
- data/lib/brakeman/checks/check_sql.rb +1 -1
- data/lib/brakeman/checks/check_unsafe_reflection_methods.rb +68 -0
- data/lib/brakeman/checks/check_verb_confusion.rb +75 -0
- data/lib/brakeman/file_parser.rb +24 -18
- data/lib/brakeman/options.rb +5 -1
- data/lib/brakeman/parsers/template_parser.rb +26 -3
- data/lib/brakeman/processors/alias_processor.rb +40 -13
- data/lib/brakeman/processors/base_processor.rb +4 -4
- data/lib/brakeman/processors/controller_processor.rb +1 -1
- data/lib/brakeman/processors/haml_template_processor.rb +8 -1
- data/lib/brakeman/processors/lib/file_type_detector.rb +64 -0
- data/lib/brakeman/processors/lib/rails3_config_processor.rb +16 -16
- data/lib/brakeman/processors/lib/rails4_config_processor.rb +2 -1
- data/lib/brakeman/processors/output_processor.rb +1 -1
- data/lib/brakeman/processors/template_alias_processor.rb +5 -0
- data/lib/brakeman/report.rb +15 -0
- data/lib/brakeman/report/report_base.rb +0 -2
- data/lib/brakeman/report/report_csv.rb +37 -60
- data/lib/brakeman/report/report_junit.rb +2 -2
- data/lib/brakeman/report/report_sarif.rb +114 -0
- data/lib/brakeman/report/report_sonar.rb +38 -0
- data/lib/brakeman/report/report_tabs.rb +1 -1
- data/lib/brakeman/report/report_text.rb +1 -1
- data/lib/brakeman/rescanner.rb +7 -5
- data/lib/brakeman/scanner.rb +44 -18
- data/lib/brakeman/tracker.rb +6 -0
- data/lib/brakeman/tracker/config.rb +73 -0
- data/lib/brakeman/tracker/controller.rb +1 -1
- data/lib/brakeman/util.rb +9 -4
- data/lib/brakeman/version.rb +1 -1
- data/lib/brakeman/warning.rb +10 -2
- data/lib/brakeman/warning_codes.rb +2 -0
- data/lib/ruby_parser/bm_sexp.rb +9 -9
- metadata +142 -84
- data/bundle/ruby/2.7.0/gems/haml-5.1.2/lib/haml/escapable.rb +0 -50
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.0/debugging.md +0 -57
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.0/lib/ruby21_parser.rb +0 -7140
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.0/lib/ruby22_parser.rb +0 -7160
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.15.0/lib/ruby27_parser.rb +0 -7224
@@ -22,6 +22,7 @@ token kCLASS kMODULE kDEF kUNDEF kBEGIN kRESCUE kENSURE kEND kIF kUNLESS
|
|
22
22
|
tRATIONAL tIMAGINARY
|
23
23
|
tLABEL_END
|
24
24
|
tLONELY
|
25
|
+
tBDOT2 tBDOT3
|
25
26
|
|
26
27
|
preclow
|
27
28
|
nonassoc tLOWEST
|
@@ -33,7 +34,7 @@ preclow
|
|
33
34
|
right tEQL tOP_ASGN
|
34
35
|
left kRESCUE_MOD
|
35
36
|
right tEH tCOLON
|
36
|
-
nonassoc tDOT2 tDOT3
|
37
|
+
nonassoc tDOT2 tDOT3 tBDOT2 tBDOT3
|
37
38
|
left tOROP
|
38
39
|
left tANDOP
|
39
40
|
nonassoc tCMP tEQ tEQQ tNEQ tMATCH tNMATCH
|
@@ -56,6 +57,9 @@ rule
|
|
56
57
|
top_compstmt
|
57
58
|
{
|
58
59
|
result = new_compstmt val
|
60
|
+
|
61
|
+
lexer.cond.pop # local_pop
|
62
|
+
lexer.cmdarg.pop
|
59
63
|
}
|
60
64
|
|
61
65
|
top_compstmt: top_stmts opt_terms
|
@@ -818,6 +822,22 @@ rule
|
|
818
822
|
|
819
823
|
result = s(:dot3, v1, v2).line v1.line
|
820
824
|
}
|
825
|
+
|
826
|
+
| tBDOT2 arg
|
827
|
+
{
|
828
|
+
_, v2, = val
|
829
|
+
v1 = nil
|
830
|
+
|
831
|
+
result = s(:dot2, v1, v2).line v2.line
|
832
|
+
}
|
833
|
+
| tBDOT3 arg
|
834
|
+
{
|
835
|
+
_, v2 = val
|
836
|
+
v1 = nil
|
837
|
+
|
838
|
+
result = s(:dot3, v1, v2).line v2.line
|
839
|
+
}
|
840
|
+
|
821
841
|
| arg tPLUS arg
|
822
842
|
{
|
823
843
|
result = new_call val[0], :+, argl(val[2])
|
@@ -989,6 +1009,16 @@ rule
|
|
989
1009
|
_, args, _ = val
|
990
1010
|
result = args
|
991
1011
|
}
|
1012
|
+
| tLPAREN2 args_forward rparen
|
1013
|
+
{
|
1014
|
+
if (!self.lexer.is_local_id(:"*") ||
|
1015
|
+
!self.lexer.is_local_id(:"**") ||
|
1016
|
+
!self.lexer.is_local_id(:"&")) then
|
1017
|
+
|
1018
|
+
yyerror("Invalid argument forwarding")
|
1019
|
+
end
|
1020
|
+
result = call_args [s(:forward_args).line(lexer.lineno)]
|
1021
|
+
}
|
992
1022
|
|
993
1023
|
opt_paren_args: none
|
994
1024
|
| paren_args
|
@@ -2269,6 +2299,19 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
|
|
2269
2299
|
self.lexer.lex_state = EXPR_BEG
|
2270
2300
|
self.lexer.command_start = true
|
2271
2301
|
}
|
2302
|
+
| tLPAREN2 args_forward rparen
|
2303
|
+
{
|
2304
|
+
args_rest = :"*"
|
2305
|
+
kwargs_rest = :"**"
|
2306
|
+
block_fwd = :"&"
|
2307
|
+
self.env[args_rest] = :lvar
|
2308
|
+
self.env[kwargs_rest] = :lvar
|
2309
|
+
self.env[block_fwd] = :lvar
|
2310
|
+
|
2311
|
+
result = s(:args, s(:forward_args)).line lexer.lineno
|
2312
|
+
self.lexer.lex_state = EXPR_BEG
|
2313
|
+
self.lexer.command_start = true
|
2314
|
+
}
|
2272
2315
|
| {
|
2273
2316
|
result = self.in_kwarg
|
2274
2317
|
self.in_kwarg = true
|
@@ -2368,6 +2411,8 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
|
|
2368
2411
|
result = args val
|
2369
2412
|
}
|
2370
2413
|
|
2414
|
+
args_forward: tBDOT3
|
2415
|
+
|
2371
2416
|
f_bad_arg: tCONSTANT
|
2372
2417
|
{
|
2373
2418
|
yyerror "formal argument cannot be a constant"
|
@@ -2496,6 +2541,7 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
|
|
2496
2541
|
| kwrest_mark
|
2497
2542
|
{
|
2498
2543
|
result = :"**"
|
2544
|
+
self.env[result] = :lvar
|
2499
2545
|
}
|
2500
2546
|
|
2501
2547
|
f_opt: f_arg_asgn tEQL arg_value
|
@@ -25,6 +25,11 @@ class RubyLexer
|
|
25
25
|
|
26
26
|
HAS_ENC = "".respond_to? :encoding
|
27
27
|
|
28
|
+
BTOKENS = {
|
29
|
+
".." => :tBDOT2,
|
30
|
+
"..." => :tBDOT3,
|
31
|
+
}
|
32
|
+
|
28
33
|
TOKENS = {
|
29
34
|
"!" => :tBANG,
|
30
35
|
"!=" => :tNEQ,
|
@@ -131,6 +136,10 @@ class RubyLexer
|
|
131
136
|
ss.eos?
|
132
137
|
end
|
133
138
|
|
139
|
+
def expr_beg?
|
140
|
+
lex_state =~ EXPR_BEG
|
141
|
+
end
|
142
|
+
|
134
143
|
def expr_dot?
|
135
144
|
lex_state =~ EXPR_DOT
|
136
145
|
end
|
@@ -580,6 +589,12 @@ class RubyLexer
|
|
580
589
|
end
|
581
590
|
end
|
582
591
|
|
592
|
+
def process_dots text
|
593
|
+
tokens = ruby27plus? && expr_beg? ? BTOKENS : TOKENS
|
594
|
+
|
595
|
+
result EXPR_BEG, tokens[text], text
|
596
|
+
end
|
597
|
+
|
583
598
|
def process_float text
|
584
599
|
rb_compile_error "Invalid numeric format" if text =~ /__/
|
585
600
|
|
@@ -1136,6 +1151,10 @@ class RubyLexer
|
|
1136
1151
|
parser.class.version <= 24
|
1137
1152
|
end
|
1138
1153
|
|
1154
|
+
def ruby27plus?
|
1155
|
+
parser.class.version >= 27
|
1156
|
+
end
|
1157
|
+
|
1139
1158
|
def scan re
|
1140
1159
|
ss.scan re
|
1141
1160
|
end
|
@@ -48,7 +48,7 @@ rule
|
|
48
48
|
| /\![=~]?/ { result :arg_state, TOKENS[text], text }
|
49
49
|
|
50
50
|
: /\./
|
51
|
-
| /\.\.\.?/
|
51
|
+
| /\.\.\.?/ process_dots
|
52
52
|
| /\.\d/ { rb_compile_error "no .<digit> floating literal anymore put 0 before dot" }
|
53
53
|
| /\./ { self.lex_state = EXPR_BEG; result EXPR_DOT, :tDOT, "." }
|
54
54
|
|
@@ -138,7 +138,7 @@ class RubyLexer
|
|
138
138
|
when ss.match?(/\./) then
|
139
139
|
case
|
140
140
|
when text = ss.scan(/\.\.\.?/) then
|
141
|
-
|
141
|
+
process_dots text
|
142
142
|
when ss.skip(/\.\d/) then
|
143
143
|
action { rb_compile_error "no .<digit> floating literal anymore put 0 before dot" }
|
144
144
|
when ss.skip(/\./) then
|
File without changes
|
@@ -46,6 +46,9 @@ token kCLASS kMODULE kDEF kUNDEF kBEGIN kRESCUE kENSURE kEND kIF kUNLESS
|
|
46
46
|
#if V >= 23
|
47
47
|
tLONELY
|
48
48
|
#endif
|
49
|
+
#if V >= 26
|
50
|
+
tBDOT2 tBDOT3
|
51
|
+
#endif
|
49
52
|
|
50
53
|
preclow
|
51
54
|
nonassoc tLOWEST
|
@@ -57,7 +60,7 @@ preclow
|
|
57
60
|
right tEQL tOP_ASGN
|
58
61
|
left kRESCUE_MOD
|
59
62
|
right tEH tCOLON
|
60
|
-
nonassoc tDOT2 tDOT3
|
63
|
+
nonassoc tDOT2 tDOT3 tBDOT2 tBDOT3
|
61
64
|
left tOROP
|
62
65
|
left tANDOP
|
63
66
|
nonassoc tCMP tEQ tEQQ tNEQ tMATCH tNMATCH
|
@@ -80,6 +83,9 @@ rule
|
|
80
83
|
top_compstmt
|
81
84
|
{
|
82
85
|
result = new_compstmt val
|
86
|
+
|
87
|
+
lexer.cond.pop # local_pop
|
88
|
+
lexer.cmdarg.pop
|
83
89
|
}
|
84
90
|
|
85
91
|
top_compstmt: top_stmts opt_terms
|
@@ -856,6 +862,24 @@ rule
|
|
856
862
|
result = s(:dot3, v1, v2).line v1.line
|
857
863
|
}
|
858
864
|
#endif
|
865
|
+
|
866
|
+
#if V >= 27
|
867
|
+
| tBDOT2 arg
|
868
|
+
{
|
869
|
+
_, v2, = val
|
870
|
+
v1 = nil
|
871
|
+
|
872
|
+
result = s(:dot2, v1, v2).line v2.line
|
873
|
+
}
|
874
|
+
| tBDOT3 arg
|
875
|
+
{
|
876
|
+
_, v2 = val
|
877
|
+
v1 = nil
|
878
|
+
|
879
|
+
result = s(:dot3, v1, v2).line v2.line
|
880
|
+
}
|
881
|
+
#endif
|
882
|
+
|
859
883
|
| arg tPLUS arg
|
860
884
|
{
|
861
885
|
result = new_call val[0], :+, argl(val[2])
|
@@ -1040,6 +1064,18 @@ rule
|
|
1040
1064
|
_, args, _ = val
|
1041
1065
|
result = args
|
1042
1066
|
}
|
1067
|
+
#if V >= 27
|
1068
|
+
| tLPAREN2 args_forward rparen
|
1069
|
+
{
|
1070
|
+
if (!self.lexer.is_local_id(:"*") ||
|
1071
|
+
!self.lexer.is_local_id(:"**") ||
|
1072
|
+
!self.lexer.is_local_id(:"&")) then
|
1073
|
+
|
1074
|
+
yyerror("Invalid argument forwarding")
|
1075
|
+
end
|
1076
|
+
result = call_args [s(:forward_args).line(lexer.lineno)]
|
1077
|
+
}
|
1078
|
+
#endif
|
1043
1079
|
|
1044
1080
|
opt_paren_args: none
|
1045
1081
|
| paren_args
|
@@ -2340,6 +2376,21 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
|
|
2340
2376
|
self.lexer.lex_state = EXPR_BEG
|
2341
2377
|
self.lexer.command_start = true
|
2342
2378
|
}
|
2379
|
+
#if V >= 27
|
2380
|
+
| tLPAREN2 args_forward rparen
|
2381
|
+
{
|
2382
|
+
args_rest = :"*"
|
2383
|
+
kwargs_rest = :"**"
|
2384
|
+
block_fwd = :"&"
|
2385
|
+
self.env[args_rest] = :lvar
|
2386
|
+
self.env[kwargs_rest] = :lvar
|
2387
|
+
self.env[block_fwd] = :lvar
|
2388
|
+
|
2389
|
+
result = s(:args, s(:forward_args)).line lexer.lineno
|
2390
|
+
self.lexer.lex_state = EXPR_BEG
|
2391
|
+
self.lexer.command_start = true
|
2392
|
+
}
|
2393
|
+
#endif
|
2343
2394
|
| {
|
2344
2395
|
result = self.in_kwarg
|
2345
2396
|
self.in_kwarg = true
|
@@ -2439,6 +2490,8 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
|
|
2439
2490
|
result = args val
|
2440
2491
|
}
|
2441
2492
|
|
2493
|
+
args_forward: tBDOT3
|
2494
|
+
|
2442
2495
|
f_bad_arg: tCONSTANT
|
2443
2496
|
{
|
2444
2497
|
yyerror "formal argument cannot be a constant"
|
@@ -2587,6 +2640,7 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
|
|
2587
2640
|
| kwrest_mark
|
2588
2641
|
{
|
2589
2642
|
result = :"**"
|
2643
|
+
self.env[result] = :lvar
|
2590
2644
|
}
|
2591
2645
|
|
2592
2646
|
#if V == 20
|
@@ -197,8 +197,8 @@ ARGF.each_line do |line|
|
|
197
197
|
puts line.gsub("true", "1").gsub("false", "0")
|
198
198
|
when /^lex_state: :?([\w|]+) -> :?([\w|]+)(?: (?:at|from) (.*))?/ then
|
199
199
|
a, b, c = $1.upcase, $2.upcase, $3
|
200
|
-
a.gsub!
|
201
|
-
b.gsub!
|
200
|
+
a.gsub!(/EXPR_/, "")
|
201
|
+
b.gsub!(/EXPR_/, "")
|
202
202
|
if c && $v then
|
203
203
|
puts "lex_state: #{a} -> #{b} at #{c}"
|
204
204
|
else
|
File without changes
|
File without changes
|
File without changes
|
data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/pt_testcase.rb
RENAMED
File without changes
|
File without changes
|
data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/sexp_matcher.rb
RENAMED
File without changes
|
data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.1 → sexp_processor-4.15.2}/lib/strict_sexp.rb
RENAMED
File without changes
|
File without changes
|
data/lib/brakeman.rb
CHANGED
@@ -66,6 +66,7 @@ module Brakeman
|
|
66
66
|
# * :run_checks - array of checks to run (run all if not specified)
|
67
67
|
# * :safe_methods - array of methods to consider safe
|
68
68
|
# * :skip_libs - do not process lib/ directory (default: false)
|
69
|
+
# * :skip_vendor - do not process vendor/ directory (default: true)
|
69
70
|
# * :skip_checks - checks not to run (run all if not specified)
|
70
71
|
# * :absolute_paths - show absolute path of each file (default: false)
|
71
72
|
# * :summary_only - only output summary section of report for plain/table (:summary_only, :no_summary, true)
|
@@ -156,10 +157,17 @@ module Brakeman
|
|
156
157
|
end
|
157
158
|
end
|
158
159
|
|
159
|
-
CONFIG_FILES =
|
160
|
-
|
161
|
-
|
162
|
-
|
160
|
+
CONFIG_FILES = begin
|
161
|
+
[
|
162
|
+
File.expand_path("~/.brakeman/config.yml"),
|
163
|
+
File.expand_path("/etc/brakeman/config.yml")
|
164
|
+
]
|
165
|
+
rescue ArgumentError
|
166
|
+
# In case $HOME or $USER aren't defined for use of `~`
|
167
|
+
[
|
168
|
+
File.expand_path("/etc/brakeman/config.yml")
|
169
|
+
]
|
170
|
+
end
|
163
171
|
|
164
172
|
def self.config_file custom_location, app_path
|
165
173
|
app_config = File.expand_path(File.join(app_path, "config", "brakeman.yml"))
|
@@ -191,6 +199,7 @@ module Brakeman
|
|
191
199
|
:report_progress => true,
|
192
200
|
:safe_methods => Set.new,
|
193
201
|
:skip_checks => Set.new,
|
202
|
+
:skip_vendor => true,
|
194
203
|
}
|
195
204
|
end
|
196
205
|
|
@@ -237,6 +246,10 @@ module Brakeman
|
|
237
246
|
[:to_table]
|
238
247
|
when :junit, :to_junit
|
239
248
|
[:to_junit]
|
249
|
+
when :sarif, :to_sarif
|
250
|
+
[:to_sarif]
|
251
|
+
when :sonar, :to_sonar
|
252
|
+
[:to_sonar]
|
240
253
|
else
|
241
254
|
[:to_text]
|
242
255
|
end
|
@@ -266,6 +279,10 @@ module Brakeman
|
|
266
279
|
:to_table
|
267
280
|
when /\.junit$/i
|
268
281
|
:to_junit
|
282
|
+
when /\.sarif$/i
|
283
|
+
:to_sarif
|
284
|
+
when /\.sonar$/i
|
285
|
+
:to_sonar
|
269
286
|
else
|
270
287
|
:to_text
|
271
288
|
end
|
data/lib/brakeman/app_tree.rb
CHANGED
@@ -21,6 +21,7 @@ module Brakeman
|
|
21
21
|
end
|
22
22
|
init_options[:additional_libs_path] = options[:additional_libs_path]
|
23
23
|
init_options[:engine_paths] = options[:engine_paths]
|
24
|
+
init_options[:skip_vendor] = options[:skip_vendor]
|
24
25
|
new(root, init_options)
|
25
26
|
end
|
26
27
|
|
@@ -62,6 +63,7 @@ module Brakeman
|
|
62
63
|
@engine_paths = init_options[:engine_paths] || []
|
63
64
|
@absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
|
64
65
|
@relative_engine_paths = @engine_paths - @absolute_engine_paths
|
66
|
+
@skip_vendor = init_options[:skip_vendor]
|
65
67
|
@gemspec = nil
|
66
68
|
@root_search_pattern = nil
|
67
69
|
end
|
@@ -96,6 +98,10 @@ module Brakeman
|
|
96
98
|
end
|
97
99
|
end
|
98
100
|
|
101
|
+
def ruby_file_paths
|
102
|
+
find_paths(".").uniq
|
103
|
+
end
|
104
|
+
|
99
105
|
def initializer_paths
|
100
106
|
@initializer_paths ||= prioritize_concerns(find_paths("config/initializers"))
|
101
107
|
end
|
@@ -109,8 +115,8 @@ module Brakeman
|
|
109
115
|
end
|
110
116
|
|
111
117
|
def template_paths
|
112
|
-
@template_paths ||= find_paths("
|
113
|
-
|
118
|
+
@template_paths ||= find_paths(".", "*.{#{VIEW_EXTENSIONS}}") +
|
119
|
+
find_paths("**", "*.{erb,haml,slim}").reject { |path| File.basename(path).count(".") > 1 }
|
114
120
|
end
|
115
121
|
|
116
122
|
def layout_exists?(name)
|
@@ -163,7 +169,8 @@ module Brakeman
|
|
163
169
|
def select_files(paths)
|
164
170
|
paths = select_only_files(paths)
|
165
171
|
paths = reject_skipped_files(paths)
|
166
|
-
convert_to_file_paths(paths)
|
172
|
+
paths = convert_to_file_paths(paths)
|
173
|
+
reject_global_excludes(paths)
|
167
174
|
end
|
168
175
|
|
169
176
|
def select_only_files(paths)
|
@@ -182,6 +189,32 @@ module Brakeman
|
|
182
189
|
end
|
183
190
|
end
|
184
191
|
|
192
|
+
EXCLUDED_PATHS = %w[
|
193
|
+
/generators/
|
194
|
+
lib/tasks/
|
195
|
+
lib/templates/
|
196
|
+
db/
|
197
|
+
spec/
|
198
|
+
test/
|
199
|
+
tmp/
|
200
|
+
public/
|
201
|
+
log/
|
202
|
+
]
|
203
|
+
|
204
|
+
def reject_global_excludes(paths)
|
205
|
+
paths.reject do |path|
|
206
|
+
relative_path = path.relative
|
207
|
+
|
208
|
+
if @skip_vendor and relative_path.include? 'vendor/'
|
209
|
+
true
|
210
|
+
else
|
211
|
+
EXCLUDED_PATHS.any? do |excluded|
|
212
|
+
relative_path.include? excluded
|
213
|
+
end
|
214
|
+
end
|
215
|
+
end
|
216
|
+
end
|
217
|
+
|
185
218
|
def match_path files, path
|
186
219
|
absolute_path = Pathname.new(path)
|
187
220
|
# relative root never has a leading separator. But, we use a leading
|