brakeman 5.0.0 → 5.1.0

data/lib/brakeman/tracker/collection.rb

@@ -1,4 +1,5 @@
 require 'brakeman/util'
+require 'brakeman/tracker/method_info'
 
 module Brakeman
   class Collection
@@ -13,6 +14,8 @@ module Brakeman
       @src = {}
       @includes = []
       @methods = { :public => {}, :private => {}, :protected => {} }
+      @class_methods = {}
+      @simple_methods = { :class => {}, instance: {} }
       @options = {}
       @tracker = tracker
 
@@ -22,7 +25,7 @@ module Brakeman
     def ancestor? parent, seen={}
       seen[self.name] = true
 
-      if self.parent == parent or seen[self.parent]
+      if self.parent == parent or self.name == parent or seen[self.parent]
         true
       elsif parent_model = collection[self.parent]
         parent_model.ancestor? parent, seen
@@ -37,7 +40,7 @@ module Brakeman
     end
 
     def add_include class_name
-      @includes << class_name
+      @includes << class_name unless ancestor?(class_name)
     end
 
     def add_option name, exp
@@ -46,11 +49,17 @@ module Brakeman
     end
 
     def add_method visibility, name, src, file_name
+      meth_info = Brakeman::MethodInfo.new(name, src, self, file_name)
+      add_simple_method_maybe meth_info
+
       if src.node_type == :defs
+        @class_methods[name] = meth_info
+
+        # TODO fix this weirdness
         name = :"#{src[1]}.#{name}"
       end
 
-      @methods[visibility][name] = { :src => src, :file => file_name }
+      @methods[visibility][name] = meth_info
     end
 
     def each_method
@@ -61,16 +70,31 @@ module Brakeman
       end
     end
 
-    def get_method name
-      each_method do |n, info|
-        if n == name
-          return info
+    def get_method name, type = :instance
+      case type
+      when :class
+        get_class_method name
+      when :instance
+        get_instance_method name
+      else
+        raise "Unexpected method type: #{type.inspect}"
+      end
+    end
+
+    def get_instance_method name
+      @methods.each do |_vis, meths|
+        if meths[name]
+          return meths[name]
         end
       end
 
       nil
     end
 
+    def get_class_method name
+      @class_methods[name]
+    end
+
     def file
       @files.first
     end
@@ -90,5 +114,31 @@ module Brakeman
     def methods_public
       @methods[:public]
     end
+
+    def get_simple_method_return_value type, name
+      @simple_methods[type][name]
+    end
+
+    private
+
+    def add_simple_method_maybe meth_info
+      if meth_info.very_simple_method?
+        add_simple_method meth_info
+      end
+    end
+
+    def add_simple_method meth_info
+      name = meth_info.name
+      value = meth_info.return_value
+
+      case meth_info.src.node_type
+      when :defn
+        @simple_methods[:instance][name] = value
+      when :defs
+        @simple_methods[:class][name] = value
+      else
+        raise "Expected sexp type: #{src.node_type}"
+      end
+    end
   end
 end

data/lib/brakeman/tracker/method_info.rb

@@ -0,0 +1,70 @@
+require 'brakeman/util'
+
+module Brakeman
+  class MethodInfo
+    include Brakeman::Util
+
+    attr_reader :name, :src, :owner, :file, :type
+
+    def initialize name, src, owner, file
+      @name = name
+      @src = src
+      @owner = owner
+      @file = file
+      @type = case src.node_type
+              when :defn
+                :instance
+              when :defs
+                :class
+              else
+                raise "Expected sexp type: #{src.node_type}"
+              end
+
+      @simple_method = nil
+    end
+
+    # To support legacy code that expected a Hash
+    def [] attr
+      self.send(attr)
+    end
+
+    def very_simple_method?
+      return @simple_method == :very unless @simple_method.nil?
+
+      # Very simple methods have one (simple) expression in the body and
+      # no arguments
+      if src.formal_args.length == 1 # no args
+        if src.method_length == 1 # Single expression in body
+          value = first_body # First expression in body
+
+          if simple_literal? value or
+              (array? value and all_literals? value) or
+              (hash? value and all_literals? value, :hash)
+
+            @return_value = value
+            @simple_method = :very
+          end
+        end
+      end
+
+      @simple_method ||= false
+    end
+
+    def return_value env = nil
+      if very_simple_method?
+        return @return_value
+      else
+        nil
+      end
+    end
+
+    def first_body
+      case @type
+      when :class
+        src[4]
+      when :instance
+        src[3]
+      end
+    end
+  end
+end

data/lib/brakeman/util.rb

@@ -50,7 +50,11 @@ module Brakeman::Util
 
   # stupid simple, used to delegate to ActiveSupport
   def pluralize word
-    word + "s"
+    if word.end_with? 's'
+      word + 'es'
+    else
+      word + 's'
+    end
   end
 
   #Returns a class name as a Symbol.
@@ -142,6 +146,14 @@ module Brakeman::Util
     nil
   end
 
+  def hash_values hash
+    values = hash.each_sexp.each_slice(2).map do |_, value|
+      value
+    end
+
+    Sexp.new(:array).concat(values).line(hash.line)
+  end
+
   #These are never modified
   PARAMS_SEXP = Sexp.new(:params)
   SESSION_SEXP = Sexp.new(:session)
@@ -230,30 +242,22 @@ module Brakeman::Util
 
   #Check if _exp_ is a params hash
   def params? exp
-    if exp.is_a? Sexp
-      return true if exp.node_type == :params or ALL_PARAMETERS.include? exp
-
-      if call? exp
-        if params? exp[1]
-          return true
-        elsif exp[2] == :[]
-          return params? exp[1]
-        end
-      end
-    end
-
-    false
+    recurse_check?(exp) { |child| child.node_type == :params or ALL_PARAMETERS.include? child }
   end
 
   def cookies? exp
+    recurse_check?(exp) { |child| child.node_type == :cookies or ALL_COOKIES.include? child }
+  end
+
+  def recurse_check? exp, &check
     if exp.is_a? Sexp
-      return true if exp.node_type == :cookies or ALL_COOKIES.include? exp
+      return true if yield(exp)
 
       if call? exp
-        if cookies? exp[1]
+        if recurse_check? exp[1], &check
           return true
         elsif exp[2] == :[]
-          return cookies? exp[1]
+          return recurse_check? exp[1], &check
         end
       end
     end
@@ -293,12 +297,24 @@ module Brakeman::Util
     exp.is_a? Sexp and types.include? exp.node_type
   end
 
-  LITERALS = [:lit, :false, :str, :true, :array, :hash]
+  SIMPLE_LITERALS = [:lit, :false, :str, :true]
+
+  def simple_literal? exp
+    exp.is_a? Sexp and SIMPLE_LITERALS.include? exp.node_type
+  end
+
+  LITERALS = [*SIMPLE_LITERALS, :array, :hash]
 
   def literal? exp
     exp.is_a? Sexp and LITERALS.include? exp.node_type
   end
 
+  def all_literals? exp, expected_type = :array
+    node_type? exp, expected_type and
+      exp.length > 1 and
+      exp.all? { |e| e.is_a? Symbol or node_type? e, :lit, :str }
+  end
+
   DIR_CONST = s(:const, :Dir)
 
   # Dir.glob(...).whatever

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "5.0.0"
+  Version = "5.1.0"
 end

data/lib/ruby_parser/bm_sexp.rb

@@ -543,6 +543,20 @@ class Sexp
     self.body.unshift :rlist
   end
 
+  # Number of "statements" in a method.
+  # This is more effecient than `Sexp#body.length`
+  # because `Sexp#body` creates a new Sexp.
+  def method_length
+    expect :defn, :defs
+
+    case self.node_type
+    when :defn
+      self.length - 3
+    when :defs
+      self.length - 4
+    end
+  end
+
   def render_type
     expect :render
     self[1]

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.1.0
 platform: ruby
 authors:
 - Justin Collins
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-01-27 00:00:00.000000000 Z
+date: 2021-07-19 00:00:00.000000000 Z
 dependencies: []
 description: Brakeman detects security vulnerabilities in Ruby on Rails applications
   via static analysis.
@@ -132,95 +132,100 @@ files:
 - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/terminal/unix_stty.rb
 - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/version.rb
 - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/wrapper.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/Gemfile
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/LICENSE.txt
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/NEWS.md
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/README.md
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attlistdecl.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/attribute.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/cdata.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/child.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/comment.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/doctype.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/document.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/attlistdecl.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/dtd.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/elementdecl.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/entitydecl.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/dtd/notationdecl.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/element.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/encoding.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/entity.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/default.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/pretty.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/formatters/transitive.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/functions.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/instruction.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/light/node.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/namespace.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/node.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/output.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parent.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parseexception.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/baseparser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/lightparser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/pullparser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/sax2parser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/streamparser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/treeparser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/ultralightparser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/parsers/xpathparser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/quickpath.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/rexml.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/sax2listener.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/security.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/source.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/streamlistener.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/text.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/undefinednamespaceexception.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/relaxng.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validation.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/validation/validationexception.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmldecl.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xmltokens.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/lib/rexml/xpath_parser.rb
-- bundle/ruby/2.7.0/gems/rexml-3.2.4/rexml.gemspec
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/MIT-LICENSE.txt
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel.rb
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/processor_count.rb
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/version.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attlistdecl.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/attribute.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/cdata.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/child.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/comment.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/doctype.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/document.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/attlistdecl.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/dtd.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/elementdecl.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/entitydecl.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/dtd/notationdecl.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/element.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/encoding.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/entity.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/default.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/pretty.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/formatters/transitive.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/functions.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/instruction.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/light/node.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/namespace.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/node.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/output.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parent.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parseexception.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/lightparser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/streamparser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/treeparser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/ultralightparser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/xpathparser.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/quickpath.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/rexml.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/sax2listener.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/security.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/source.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/streamlistener.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/text.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/undefinednamespaceexception.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/relaxng.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validation.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/validation/validationexception.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmldecl.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xmltokens.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath.rb
+- bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/xpath_parser.rb
 - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/History.rdoc
 - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/Manifest.txt
 - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/README.rdoc
 - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib/ruby2ruby.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/History.rdoc
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/Manifest.txt
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/README.rdoc
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/compare/normalize.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/debugging.md
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/rp_extensions.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/rp_stringscanner.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby20_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby20_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby21_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby21_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby23_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby23_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby24_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby24_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby25_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby25_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby26_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby26_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rex
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rex.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser.yy
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser_extras.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/tools/munge.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/tools/ripper.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/History.rdoc
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/Manifest.txt
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/README.rdoc
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/compare/normalize.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/debugging.md
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/rp_extensions.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/rp_stringscanner.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby20_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby20_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby21_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby21_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby22_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby22_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby24_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby24_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby26_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby26_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby27_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby27_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_lexer.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_lexer.rex
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_lexer.rex.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_parser.yy
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_parser_extras.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/tools/munge.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/tools/ripper.rb
 - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/History.rdoc
 - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/Manifest.txt
 - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/README.rdoc
@@ -265,16 +270,16 @@ files:
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib/safe_yaml/version.rb
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/run_specs_all_ruby_versions.sh
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/safe_yaml.gemspec
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/History.rdoc
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/Manifest.txt
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/README.rdoc
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/composite_sexp_processor.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/pt_testcase.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp_matcher.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp_processor.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/strict_sexp.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/unique.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/History.rdoc
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/Manifest.txt
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/README.rdoc
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/composite_sexp_processor.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/pt_testcase.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/sexp.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/sexp_matcher.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/sexp_processor.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/strict_sexp.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/unique.rb
 - bundle/ruby/2.7.0/gems/slim-4.1.0/CHANGES
 - bundle/ruby/2.7.0/gems/slim-4.1.0/Gemfile
 - bundle/ruby/2.7.0/gems/slim-4.1.0/LICENSE
@@ -567,6 +572,7 @@ files:
 - lib/brakeman/report/report_base.rb
 - lib/brakeman/report/report_codeclimate.rb
 - lib/brakeman/report/report_csv.rb
+- lib/brakeman/report/report_github.rb
 - lib/brakeman/report/report_hash.rb
 - lib/brakeman/report/report_html.rb
 - lib/brakeman/report/report_json.rb
@@ -596,6 +602,7 @@ files:
 - lib/brakeman/tracker/constants.rb
 - lib/brakeman/tracker/controller.rb
 - lib/brakeman/tracker/library.rb
+- lib/brakeman/tracker/method_info.rb
 - lib/brakeman/tracker/model.rb
 - lib/brakeman/tracker/template.rb
 - lib/brakeman/util.rb