brakeman 5.0.1 → 5.0.2

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -51,7 +51,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
         #Need to process the method like it was in a controller in order
         #to get the renders set
         processor = Brakeman::ControllerProcessor.new(@tracker, mixin.file)
-        method = mixin.get_method(name)[:src].deep_clone
+        method = mixin.get_method(name).src.deep_clone
 
         if node_type? method, :defn
           method = processor.process_defn method
@@ -143,16 +143,16 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
   #Basically, adds any instance variable assignments to the environment.
   #TODO: method arguments?
   def process_before_filter name
-    filter = find_method name, @current_class
+    filter = tracker.find_method name, @current_class
 
     if filter.nil?
       Brakeman.debug "[Notice] Could not find filter #{name}"
       return
     end
 
-    method = filter[:method]
+    method = filter.src
 
-    if ivars = @tracker.filter_cache[[filter[:controller], name]]
+    if ivars = @tracker.filter_cache[[filter.owner, name]]
       ivars.each do |variable, value|
         env[variable] = value
       end
@@ -162,7 +162,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
 
       ivars = processor.only_ivars(:include_request_vars).all
 
-      @tracker.filter_cache[[filter[:controller], name]] = ivars
+      @tracker.filter_cache[[filter.owner, name]] = ivars
 
       ivars.each do |variable, value|
         env[variable] = value
@@ -182,7 +182,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
     # method as the line number
     if line.nil? and controller = @tracker.controllers[@current_class]
       if meth = controller.get_method(@current_method)
-        if line = meth[:src] && meth[:src].last && meth[:src].last.line
+        if line = meth.src && meth.src.last && meth.src.last.line
           line += 1
         else
           line = 1
@@ -241,41 +241,4 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
       []
     end
   end
-
-  #Finds a method in the given class or a parent class
-  #
-  #Returns nil if the method could not be found.
-  #
-  #If found, returns hash table with controller name and method sexp.
-  def find_method method_name, klass
-    return nil if sexp? method_name
-    method_name = method_name.to_sym
-
-    if method = @method_cache[method_name]
-      return method
-    end
-
-    controller = @tracker.controllers[klass]
-    controller ||= @tracker.libs[klass]
-
-    if klass and controller
-      method = controller.get_method method_name
-
-      if method.nil?
-        controller.includes.each do |included|
-          method = find_method method_name, included
-          if method
-            @method_cache[method_name] = method
-            return method
-          end
-       end
-
-        @method_cache[method_name] = find_method method_name, controller.parent
-      else
-        @method_cache[method_name] = { :controller => controller.name, :method => method[:src] }
-      end
-    else
-      nil
-    end
-  end
 end

data/lib/brakeman/processors/lib/call_conversion_helper.rb

@@ -76,6 +76,8 @@ module Brakeman
 
         #Have to do this because first element is :array and we have to skip it
         array[1..-1][index] or original_exp
+      elsif all_literals? array
+        safe_literal(array.line)
       else
         original_exp
       end
@@ -92,5 +94,13 @@ module Brakeman
         original_exp
       end
     end
+
+    def hash_values_at hash, keys
+      values = keys.map do |key|
+        process_hash_access hash, key
+      end
+
+      Sexp.new(:array).concat(values).line(hash.line)
+    end
   end
 end

data/lib/brakeman/processors/library_processor.rb

@@ -54,6 +54,15 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
 
   def process_call exp
     if process_call_defn? exp
+      exp
+    elsif @current_method.nil? and exp.target.nil? and (@current_class or @current_module)
+      # Methods called inside class / module
+      case exp.method
+      when :include
+        module_name = class_name(exp.first_arg)
+        (@current_class || @current_module).add_include module_name
+      end
+
       exp
     else
       process_default exp

data/lib/brakeman/report.rb

@@ -6,7 +6,7 @@ require 'brakeman/report/report_base'
 class Brakeman::Report
   attr_reader :tracker
 
-  VALID_FORMATS = [:to_html, :to_pdf, :to_csv, :to_json, :to_tabs, :to_hash, :to_s, :to_markdown, :to_codeclimate, :to_plain, :to_text, :to_junit]
+  VALID_FORMATS = [:to_html, :to_pdf, :to_csv, :to_json, :to_tabs, :to_hash, :to_s, :to_markdown, :to_codeclimate, :to_plain, :to_text, :to_junit, :to_github]
 
   def initialize tracker
     @app_tree = tracker.app_tree
@@ -48,6 +48,9 @@ class Brakeman::Report
     when :to_sonar
       require_report 'sonar'
       Brakeman::Report::Sonar
+    when :to_github
+      require_report 'github'
+      Brakeman::Report::Github
     else
       raise "Invalid format: #{format}. Should be one of #{VALID_FORMATS.inspect}"
     end

data/lib/brakeman/report/ignore/interactive.rb

@@ -62,7 +62,7 @@ module Brakeman
           process_warnings
         end
 
-        m.choice "Hide previously ignored warnings" do
+        m.choice "Inspect new warnings" do
           @skip_ignored = true
           pre_show_help
           process_warnings

data/lib/brakeman/report/report_github.rb

@@ -0,0 +1,31 @@
+# Github Actions Formatter
+# Formats warnings as workflow commands to create annotations in GitHub UI
+class Brakeman::Report::Github < Brakeman::Report::Base
+  def generate_report
+    # @see https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#setting-a-warning-message
+    errors.concat(warnings).join("\n")
+  end
+
+  def warnings
+    all_warnings
+      .map { |warning| "::warning file=#{warning_file(warning)},line=#{warning.line}::#{warning.message}" }
+  end
+
+  def errors
+    tracker.errors.map do |error|
+      if error[:exception].is_a?(Racc::ParseError)
+        # app/services/balance.rb:4 :: parse error on value "..." (tDOT3)
+        file, line = error[:exception].message.split(':').map(&:strip)[0,2]
+        "::error file=#{file},line=#{line}::#{clean_message(error[:error])}"
+      else
+        "::error ::#{clean_message(error[:error])}"
+      end
+    end
+  end
+
+  private
+
+  def clean_message(msg)
+    msg.gsub('::','').squeeze(' ')
+  end
+end

data/lib/brakeman/scanner.rb

@@ -353,6 +353,9 @@ class Brakeman::Scanner
   def parse_ruby_file file
     fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
     fp.parse_ruby(file.read, file)
+  rescue Exception => e
+    tracker.error(e)
+    nil
   end
 end
 

data/lib/brakeman/tracker.rb

@@ -35,6 +35,7 @@ class Brakeman::Tracker
     #class they are.
     @models = {}
     @models[UNKNOWN_MODEL] = Brakeman::Model.new(UNKNOWN_MODEL, nil, @app_tree.file_path("NOT_REAL.rb"), nil, self)
+    @method_cache = {}
     @routes = {}
     @initializers = {}
     @errors = []
@@ -99,8 +100,8 @@ class Brakeman::Tracker
     classes.each do |set|
       set.each do |set_name, collection|
         collection.each_method do |method_name, definition|
-          src = definition[:src]
-          yield src, set_name, method_name, definition[:file]
+          src = definition.src
+          yield src, set_name, method_name, definition.file
         end
       end
     end
@@ -220,6 +221,34 @@ class Brakeman::Tracker
     nil
   end
 
+  def find_method method_name, class_name, method_type = :instance
+    return nil unless method_name.is_a? Symbol
+
+    klass = find_class(class_name)
+    return nil unless klass
+
+    cache_key = [klass, method_name, method_type]
+
+    if method = @method_cache[cache_key]
+      return method
+    end
+
+    if method = klass.get_method(method_name, method_type)
+      return method
+    else
+      # Check modules included for method definition
+      # TODO: only for instance methods, otherwise check extends!
+      klass.includes.each do |included_name|
+        if method = find_method(method_name, included_name, method_type)
+          return (@method_cache[cache_key] = method)
+        end
+      end
+
+      # Not in any included modules, check the parent
+      @method_cache[cache_key] = find_method(method_name, klass.parent)
+    end
+  end
+
   def index_call_sites
     finder = Brakeman::FindAllCalls.new self
 
@@ -285,8 +314,8 @@ class Brakeman::Tracker
     method_sets.each do |set|
       set.each do |set_name, info|
         info.each_method do |method_name, definition|
-          src = definition[:src]
-          finder.process_source src, :class => set_name, :method => method_name, :file => definition[:file]
+          src = definition.src
+          finder.process_source src, :class => set_name, :method => method_name, :file => definition.file
         end
       end
     end

data/lib/brakeman/tracker/collection.rb

@@ -1,4 +1,5 @@
 require 'brakeman/util'
+require 'brakeman/tracker/method_info'
 
 module Brakeman
   class Collection
@@ -13,6 +14,7 @@ module Brakeman
       @src = {}
       @includes = []
       @methods = { :public => {}, :private => {}, :protected => {} }
+      @class_methods = {}
       @options = {}
       @tracker = tracker
 
@@ -46,11 +48,16 @@ module Brakeman
     end
 
     def add_method visibility, name, src, file_name
+      meth_info = Brakeman::MethodInfo.new(name, src, self, file_name)
+
       if src.node_type == :defs
+        @class_methods[name] = meth_info
+
+        # TODO fix this weirdness
         name = :"#{src[1]}.#{name}"
       end
 
-      @methods[visibility][name] = { :src => src, :file => file_name }
+      @methods[visibility][name] = meth_info
     end
 
     def each_method
@@ -61,16 +68,31 @@ module Brakeman
       end
     end
 
-    def get_method name
-      each_method do |n, info|
-        if n == name
-          return info
+    def get_method name, type = :instance
+      case type
+      when :class
+        get_class_method name
+      when :instance
+        get_instance_method name
+      else
+        raise "Unexpected method type: #{type.inspect}"
+      end
+    end
+
+    def get_instance_method name
+      @methods.each do |_vis, meths|
+        if meths[name]
+          return meths[name]
         end
       end
 
       nil
     end
 
+    def get_class_method name
+      @class_methods[name]
+    end
+
     def file
       @files.first
     end

data/lib/brakeman/tracker/method_info.rb

@@ -0,0 +1,29 @@
+require 'brakeman/util'
+
+module Brakeman
+  class MethodInfo
+    include Brakeman::Util
+
+    attr_reader :name, :src, :owner, :file, :type
+
+    def initialize name, src, owner, file
+      @name = name
+      @src = src
+      @owner = owner
+      @file = file
+      @type = case src.node_type
+              when :defn
+                :instance
+              when :defs
+                :class
+              else
+                raise "Expected sexp type: #{src.node_type}"
+              end
+    end
+
+    # To support legacy code that expected a Hash
+    def [] attr
+      self.send(attr)
+    end
+  end
+end

data/lib/brakeman/util.rb

@@ -142,6 +142,14 @@ module Brakeman::Util
     nil
   end
 
+  def hash_values hash
+    values = hash.each_sexp.each_slice(2).map do |_, value|
+      value
+    end
+
+    Sexp.new(:array).concat(values).line(hash.line)
+  end
+
   #These are never modified
   PARAMS_SEXP = Sexp.new(:params)
   SESSION_SEXP = Sexp.new(:session)

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "5.0.1"
+  Version = "5.0.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 5.0.1
+  version: 5.0.2
 platform: ruby
 authors:
 - Justin Collins
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-28 00:00:00.000000000 Z
+date: 2021-06-07 00:00:00.000000000 Z
 dependencies: []
 description: Brakeman detects security vulnerabilities in Ruby on Rails applications
   via static analysis.
@@ -132,6 +132,10 @@ files:
 - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/terminal/unix_stty.rb
 - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/version.rb
 - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/wrapper.rb
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/MIT-LICENSE.txt
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel.rb
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/processor_count.rb
+- bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/version.rb
 - bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt
 - bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md
 - bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md
@@ -189,37 +193,39 @@ files:
 - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/Manifest.txt
 - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/README.rdoc
 - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib/ruby2ruby.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/History.rdoc
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/Manifest.txt
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/README.rdoc
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/compare/normalize.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/debugging.md
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/rp_extensions.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/rp_stringscanner.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby20_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby20_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby21_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby21_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby22_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby23_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby23_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby24_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby24_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby25_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby25_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby26_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby26_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby27_parser.y
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rex
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_lexer.rex.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser.yy
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/lib/ruby_parser_extras.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/tools/munge.rb
-- bundle/ruby/2.7.0/gems/ruby_parser-3.15.1/tools/ripper.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/History.rdoc
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/Manifest.txt
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/README.rdoc
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/compare/normalize.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/debugging.md
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/rp_extensions.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/rp_stringscanner.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby20_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby20_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby21_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby21_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby22_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby22_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby24_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby24_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby26_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby26_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby27_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby27_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.y
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_lexer.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_lexer.rex
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_lexer.rex.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_parser.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_parser.yy
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby_parser_extras.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/tools/munge.rb
+- bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/tools/ripper.rb
 - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/History.rdoc
 - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/Manifest.txt
 - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/README.rdoc
@@ -264,16 +270,16 @@ files:
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib/safe_yaml/version.rb
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/run_specs_all_ruby_versions.sh
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/safe_yaml.gemspec
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/History.rdoc
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/Manifest.txt
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/README.rdoc
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/composite_sexp_processor.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/pt_testcase.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp_matcher.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/sexp_processor.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/strict_sexp.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.15.2/lib/unique.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/History.rdoc
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/Manifest.txt
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/README.rdoc
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/composite_sexp_processor.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/pt_testcase.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/sexp.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/sexp_matcher.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/sexp_processor.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/strict_sexp.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.15.3/lib/unique.rb
 - bundle/ruby/2.7.0/gems/slim-4.1.0/CHANGES
 - bundle/ruby/2.7.0/gems/slim-4.1.0/Gemfile
 - bundle/ruby/2.7.0/gems/slim-4.1.0/LICENSE
@@ -566,6 +572,7 @@ files:
 - lib/brakeman/report/report_base.rb
 - lib/brakeman/report/report_codeclimate.rb
 - lib/brakeman/report/report_csv.rb
+- lib/brakeman/report/report_github.rb
 - lib/brakeman/report/report_hash.rb
 - lib/brakeman/report/report_html.rb
 - lib/brakeman/report/report_json.rb
@@ -595,6 +602,7 @@ files:
 - lib/brakeman/tracker/constants.rb
 - lib/brakeman/tracker/controller.rb
 - lib/brakeman/tracker/library.rb
+- lib/brakeman/tracker/method_info.rb
 - lib/brakeman/tracker/model.rb
 - lib/brakeman/tracker/template.rb
 - lib/brakeman/util.rb