brakeman 5.0.4 → 5.1.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGES.md +40 -1
- data/README.md +1 -1
- data/bundle/load.rb +5 -4
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/CHANGELOG.md +8 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/FAQ.md +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/Gemfile +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/MIT-LICENSE +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/README.md +19 -13
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/REFERENCE.md +10 -3
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/TODO +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/haml.gemspec +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/attribute_builder.rb +55 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/attribute_compiler.rb +4 -2
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/attribute_parser.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/buffer.rb +0 -56
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/compiler.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/engine.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/error.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/escapable.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/exec.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/filters.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/generator.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/action_view_extensions.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/action_view_mods.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/safe_erubi_template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/safe_erubis_template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/xss_mods.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/options.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/parser.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/plugin.rb +18 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/railtie.rb +5 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/sass_rails_filter.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/template/options.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/template.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/temple_engine.rb +2 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/temple_line_counter.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/util.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/version.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/yard/default/fulldoc/html/css/common.sass +0 -0
- data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/yard/default/layout/html/footer.erb +0 -0
- data/bundle/ruby/2.7.0/gems/parallel-1.21.0/MIT-LICENSE.txt +20 -0
- data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/processor_count.rb +45 -0
- data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb +4 -0
- data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel.rb +532 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/History.rdoc +76 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/Manifest.txt +3 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/README.rdoc +1 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/compare/normalize.rb +6 -1
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/debugging.md +0 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/gauntlet.md +106 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/rp_extensions.rb +15 -36
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/rp_stringscanner.rb +33 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby20_parser.rb +7122 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby20_parser.y +326 -249
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby21_parser.rb +7176 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby21_parser.y +321 -246
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby22_parser.rb +7222 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby22_parser.y +325 -248
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby23_parser.rb +7231 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby24_parser.y → ruby_parser-3.18.0/lib/ruby23_parser.y} +326 -257
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby24_parser.rb +7262 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby30_parser.y → ruby_parser-3.18.0/lib/ruby24_parser.y} +327 -302
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby25_parser.rb +7262 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby26_parser.y → ruby_parser-3.18.0/lib/ruby25_parser.y} +326 -264
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby26_parser.rb +7281 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby27_parser.y → ruby_parser-3.18.0/lib/ruby26_parser.y} +325 -285
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby27_parser.rb +8511 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby_parser.yy → ruby_parser-3.18.0/lib/ruby27_parser.y} +897 -377
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby30_parser.rb +8741 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby30_parser.y +3463 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby3_parser.yy +3467 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby_lexer.rb +261 -609
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby_lexer.rex +27 -20
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby_lexer.rex.rb +59 -23
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby_lexer_strings.rb +638 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby_parser.rb +0 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/lib/ruby_parser.yy +3481 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/lib/ruby_parser_extras.rb +296 -115
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.0}/tools/munge.rb +34 -6
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.0/tools/ripper.rb +44 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/History.rdoc +15 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/Manifest.txt +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/README.rdoc +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/composite_sexp_processor.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/pt_testcase.rb +7 -2
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/sexp.rb +19 -9
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/sexp_matcher.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/sexp_processor.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/strict_sexp.rb +25 -3
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/unique.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/CHANGELOG.md +4 -0
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/MIT-LICENSE.txt +0 -0
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/README.md +1 -1
- data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/data/display_width.marshal.gz +0 -0
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/constants.rb +2 -2
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/index.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/no_string_ext.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/string_ext.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width.rb +0 -0
- data/lib/brakeman/app_tree.rb +1 -1
- data/lib/brakeman/checks/check_detailed_exceptions.rb +1 -1
- data/lib/brakeman/checks/check_evaluation.rb +1 -1
- data/lib/brakeman/checks/check_execute.rb +10 -0
- data/lib/brakeman/checks/check_json_parsing.rb +1 -1
- data/lib/brakeman/checks/check_render.rb +15 -1
- data/lib/brakeman/checks/check_sql.rb +58 -8
- data/lib/brakeman/checks/check_verb_confusion.rb +1 -1
- data/lib/brakeman/file_parser.rb +45 -15
- data/lib/brakeman/options.rb +7 -2
- data/lib/brakeman/processors/alias_processor.rb +91 -9
- data/lib/brakeman/processors/controller_alias_processor.rb +6 -43
- data/lib/brakeman/processors/haml_template_processor.rb +9 -0
- data/lib/brakeman/processors/lib/call_conversion_helper.rb +12 -6
- data/lib/brakeman/processors/library_processor.rb +9 -0
- data/lib/brakeman/processors/model_processor.rb +32 -0
- data/lib/brakeman/report/ignore/config.rb +1 -1
- data/lib/brakeman/report/ignore/interactive.rb +1 -1
- data/lib/brakeman/report/report_csv.rb +1 -1
- data/lib/brakeman/report/report_github.rb +31 -0
- data/lib/brakeman/report/report_sarif.rb +22 -3
- data/lib/brakeman/report/report_text.rb +1 -1
- data/lib/brakeman/report.rb +4 -1
- data/lib/brakeman/rescanner.rb +1 -1
- data/lib/brakeman/scanner.rb +16 -13
- data/lib/brakeman/tracker/collection.rb +57 -7
- data/lib/brakeman/tracker/method_info.rb +70 -0
- data/lib/brakeman/tracker.rb +33 -4
- data/lib/brakeman/util.rb +34 -18
- data/lib/brakeman/version.rb +1 -1
- data/lib/brakeman.rb +8 -2
- data/lib/ruby_parser/bm_sexp.rb +24 -0
- metadata +103 -94
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/rp_stringscanner.rb +0 -64
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby20_parser.rb +0 -7075
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby21_parser.rb +0 -7148
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby22_parser.rb +0 -7185
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.rb +0 -7199
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.y +0 -2643
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby24_parser.rb +0 -7219
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.rb +0 -7218
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.y +0 -2651
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby26_parser.rb +0 -7240
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby27_parser.rb +0 -7358
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.rb +0 -7358
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/tools/ripper.rb +0 -39
- data/bundle/ruby/2.7.0/gems/unicode-display_width-1.7.0/data/display_width.marshal.gz +0 -0
data/lib/brakeman/rescanner.rb
CHANGED
@@ -391,7 +391,7 @@ class Brakeman::Rescanner < Brakeman::Scanner
|
|
391
391
|
|
392
392
|
def parse_ruby_files list
|
393
393
|
paths = list.select(&:exists?)
|
394
|
-
file_parser = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
|
394
|
+
file_parser = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout], tracker.options[:parallel_checks])
|
395
395
|
file_parser.parse_files paths
|
396
396
|
tracker.add_errors(file_parser.errors)
|
397
397
|
file_parser.file_list
|
data/lib/brakeman/scanner.rb
CHANGED
@@ -40,38 +40,38 @@ class Brakeman::Scanner
|
|
40
40
|
|
41
41
|
#Process everything in the Rails application
|
42
42
|
def process
|
43
|
-
Brakeman.notify "Processing gems..."
|
43
|
+
Brakeman.notify "Processing gems... "
|
44
44
|
process_gems
|
45
45
|
guess_rails_version
|
46
|
-
Brakeman.notify "Processing configuration..."
|
46
|
+
Brakeman.notify "Processing configuration... "
|
47
47
|
process_config
|
48
|
-
Brakeman.notify "Parsing files..."
|
48
|
+
Brakeman.notify "Parsing files... "
|
49
49
|
parse_files
|
50
|
-
Brakeman.notify "Detecting file types..."
|
50
|
+
Brakeman.notify "Detecting file types... "
|
51
51
|
detect_file_types
|
52
|
-
Brakeman.notify "Processing initializers..."
|
52
|
+
Brakeman.notify "Processing initializers... "
|
53
53
|
process_initializers
|
54
|
-
Brakeman.notify "Processing libs..."
|
54
|
+
Brakeman.notify "Processing libs... "
|
55
55
|
process_libs
|
56
|
-
Brakeman.notify "Processing routes...
|
56
|
+
Brakeman.notify "Processing routes... "
|
57
57
|
process_routes
|
58
|
-
Brakeman.notify "Processing templates...
|
58
|
+
Brakeman.notify "Processing templates... "
|
59
59
|
process_templates
|
60
|
-
Brakeman.notify "Processing data flow in templates..."
|
60
|
+
Brakeman.notify "Processing data flow in templates... "
|
61
61
|
process_template_data_flows
|
62
|
-
Brakeman.notify "Processing models...
|
62
|
+
Brakeman.notify "Processing models... "
|
63
63
|
process_models
|
64
|
-
Brakeman.notify "Processing controllers...
|
64
|
+
Brakeman.notify "Processing controllers... "
|
65
65
|
process_controllers
|
66
66
|
Brakeman.notify "Processing data flow in controllers..."
|
67
67
|
process_controller_data_flows
|
68
|
-
Brakeman.notify "Indexing call sites...
|
68
|
+
Brakeman.notify "Indexing call sites... "
|
69
69
|
index_call_sites
|
70
70
|
tracker
|
71
71
|
end
|
72
72
|
|
73
73
|
def parse_files
|
74
|
-
fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
|
74
|
+
fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout], tracker.options[:parallel_checks])
|
75
75
|
|
76
76
|
fp.parse_files tracker.app_tree.ruby_file_paths
|
77
77
|
|
@@ -353,6 +353,9 @@ class Brakeman::Scanner
|
|
353
353
|
def parse_ruby_file file
|
354
354
|
fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
|
355
355
|
fp.parse_ruby(file.read, file)
|
356
|
+
rescue Exception => e
|
357
|
+
tracker.error(e)
|
358
|
+
nil
|
356
359
|
end
|
357
360
|
end
|
358
361
|
|
@@ -1,4 +1,5 @@
|
|
1
1
|
require 'brakeman/util'
|
2
|
+
require 'brakeman/tracker/method_info'
|
2
3
|
|
3
4
|
module Brakeman
|
4
5
|
class Collection
|
@@ -13,6 +14,8 @@ module Brakeman
|
|
13
14
|
@src = {}
|
14
15
|
@includes = []
|
15
16
|
@methods = { :public => {}, :private => {}, :protected => {} }
|
17
|
+
@class_methods = {}
|
18
|
+
@simple_methods = { :class => {}, instance: {} }
|
16
19
|
@options = {}
|
17
20
|
@tracker = tracker
|
18
21
|
|
@@ -22,7 +25,7 @@ module Brakeman
|
|
22
25
|
def ancestor? parent, seen={}
|
23
26
|
seen[self.name] = true
|
24
27
|
|
25
|
-
if self.parent == parent or seen[self.parent]
|
28
|
+
if self.parent == parent or self.name == parent or seen[self.parent]
|
26
29
|
true
|
27
30
|
elsif parent_model = collection[self.parent]
|
28
31
|
parent_model.ancestor? parent, seen
|
@@ -37,7 +40,7 @@ module Brakeman
|
|
37
40
|
end
|
38
41
|
|
39
42
|
def add_include class_name
|
40
|
-
@includes << class_name
|
43
|
+
@includes << class_name unless ancestor?(class_name)
|
41
44
|
end
|
42
45
|
|
43
46
|
def add_option name, exp
|
@@ -46,11 +49,17 @@ module Brakeman
|
|
46
49
|
end
|
47
50
|
|
48
51
|
def add_method visibility, name, src, file_name
|
52
|
+
meth_info = Brakeman::MethodInfo.new(name, src, self, file_name)
|
53
|
+
add_simple_method_maybe meth_info
|
54
|
+
|
49
55
|
if src.node_type == :defs
|
56
|
+
@class_methods[name] = meth_info
|
57
|
+
|
58
|
+
# TODO fix this weirdness
|
50
59
|
name = :"#{src[1]}.#{name}"
|
51
60
|
end
|
52
61
|
|
53
|
-
@methods[visibility][name] =
|
62
|
+
@methods[visibility][name] = meth_info
|
54
63
|
end
|
55
64
|
|
56
65
|
def each_method
|
@@ -61,16 +70,31 @@ module Brakeman
|
|
61
70
|
end
|
62
71
|
end
|
63
72
|
|
64
|
-
def get_method name
|
65
|
-
|
66
|
-
|
67
|
-
|
73
|
+
def get_method name, type = :instance
|
74
|
+
case type
|
75
|
+
when :class
|
76
|
+
get_class_method name
|
77
|
+
when :instance
|
78
|
+
get_instance_method name
|
79
|
+
else
|
80
|
+
raise "Unexpected method type: #{type.inspect}"
|
81
|
+
end
|
82
|
+
end
|
83
|
+
|
84
|
+
def get_instance_method name
|
85
|
+
@methods.each do |_vis, meths|
|
86
|
+
if meths[name]
|
87
|
+
return meths[name]
|
68
88
|
end
|
69
89
|
end
|
70
90
|
|
71
91
|
nil
|
72
92
|
end
|
73
93
|
|
94
|
+
def get_class_method name
|
95
|
+
@class_methods[name]
|
96
|
+
end
|
97
|
+
|
74
98
|
def file
|
75
99
|
@files.first
|
76
100
|
end
|
@@ -90,5 +114,31 @@ module Brakeman
|
|
90
114
|
def methods_public
|
91
115
|
@methods[:public]
|
92
116
|
end
|
117
|
+
|
118
|
+
def get_simple_method_return_value type, name
|
119
|
+
@simple_methods[type][name]
|
120
|
+
end
|
121
|
+
|
122
|
+
private
|
123
|
+
|
124
|
+
def add_simple_method_maybe meth_info
|
125
|
+
if meth_info.very_simple_method?
|
126
|
+
add_simple_method meth_info
|
127
|
+
end
|
128
|
+
end
|
129
|
+
|
130
|
+
def add_simple_method meth_info
|
131
|
+
name = meth_info.name
|
132
|
+
value = meth_info.return_value
|
133
|
+
|
134
|
+
case meth_info.src.node_type
|
135
|
+
when :defn
|
136
|
+
@simple_methods[:instance][name] = value
|
137
|
+
when :defs
|
138
|
+
@simple_methods[:class][name] = value
|
139
|
+
else
|
140
|
+
raise "Expected sexp type: #{src.node_type}"
|
141
|
+
end
|
142
|
+
end
|
93
143
|
end
|
94
144
|
end
|
@@ -0,0 +1,70 @@
|
|
1
|
+
require 'brakeman/util'
|
2
|
+
|
3
|
+
module Brakeman
|
4
|
+
class MethodInfo
|
5
|
+
include Brakeman::Util
|
6
|
+
|
7
|
+
attr_reader :name, :src, :owner, :file, :type
|
8
|
+
|
9
|
+
def initialize name, src, owner, file
|
10
|
+
@name = name
|
11
|
+
@src = src
|
12
|
+
@owner = owner
|
13
|
+
@file = file
|
14
|
+
@type = case src.node_type
|
15
|
+
when :defn
|
16
|
+
:instance
|
17
|
+
when :defs
|
18
|
+
:class
|
19
|
+
else
|
20
|
+
raise "Expected sexp type: #{src.node_type}"
|
21
|
+
end
|
22
|
+
|
23
|
+
@simple_method = nil
|
24
|
+
end
|
25
|
+
|
26
|
+
# To support legacy code that expected a Hash
|
27
|
+
def [] attr
|
28
|
+
self.send(attr)
|
29
|
+
end
|
30
|
+
|
31
|
+
def very_simple_method?
|
32
|
+
return @simple_method == :very unless @simple_method.nil?
|
33
|
+
|
34
|
+
# Very simple methods have one (simple) expression in the body and
|
35
|
+
# no arguments
|
36
|
+
if src.formal_args.length == 1 # no args
|
37
|
+
if src.method_length == 1 # Single expression in body
|
38
|
+
value = first_body # First expression in body
|
39
|
+
|
40
|
+
if simple_literal? value or
|
41
|
+
(array? value and all_literals? value) or
|
42
|
+
(hash? value and all_literals? value, :hash)
|
43
|
+
|
44
|
+
@return_value = value
|
45
|
+
@simple_method = :very
|
46
|
+
end
|
47
|
+
end
|
48
|
+
end
|
49
|
+
|
50
|
+
@simple_method ||= false
|
51
|
+
end
|
52
|
+
|
53
|
+
def return_value env = nil
|
54
|
+
if very_simple_method?
|
55
|
+
return @return_value
|
56
|
+
else
|
57
|
+
nil
|
58
|
+
end
|
59
|
+
end
|
60
|
+
|
61
|
+
def first_body
|
62
|
+
case @type
|
63
|
+
when :class
|
64
|
+
src[4]
|
65
|
+
when :instance
|
66
|
+
src[3]
|
67
|
+
end
|
68
|
+
end
|
69
|
+
end
|
70
|
+
end
|
data/lib/brakeman/tracker.rb
CHANGED
@@ -35,6 +35,7 @@ class Brakeman::Tracker
|
|
35
35
|
#class they are.
|
36
36
|
@models = {}
|
37
37
|
@models[UNKNOWN_MODEL] = Brakeman::Model.new(UNKNOWN_MODEL, nil, @app_tree.file_path("NOT_REAL.rb"), nil, self)
|
38
|
+
@method_cache = {}
|
38
39
|
@routes = {}
|
39
40
|
@initializers = {}
|
40
41
|
@errors = []
|
@@ -99,8 +100,8 @@ class Brakeman::Tracker
|
|
99
100
|
classes.each do |set|
|
100
101
|
set.each do |set_name, collection|
|
101
102
|
collection.each_method do |method_name, definition|
|
102
|
-
src = definition
|
103
|
-
yield src, set_name, method_name, definition
|
103
|
+
src = definition.src
|
104
|
+
yield src, set_name, method_name, definition.file
|
104
105
|
end
|
105
106
|
end
|
106
107
|
end
|
@@ -220,6 +221,34 @@ class Brakeman::Tracker
|
|
220
221
|
nil
|
221
222
|
end
|
222
223
|
|
224
|
+
def find_method method_name, class_name, method_type = :instance
|
225
|
+
return nil unless method_name.is_a? Symbol
|
226
|
+
|
227
|
+
klass = find_class(class_name)
|
228
|
+
return nil unless klass
|
229
|
+
|
230
|
+
cache_key = [klass, method_name, method_type]
|
231
|
+
|
232
|
+
if method = @method_cache[cache_key]
|
233
|
+
return method
|
234
|
+
end
|
235
|
+
|
236
|
+
if method = klass.get_method(method_name, method_type)
|
237
|
+
return method
|
238
|
+
else
|
239
|
+
# Check modules included for method definition
|
240
|
+
# TODO: only for instance methods, otherwise check extends!
|
241
|
+
klass.includes.each do |included_name|
|
242
|
+
if method = find_method(method_name, included_name, method_type)
|
243
|
+
return (@method_cache[cache_key] = method)
|
244
|
+
end
|
245
|
+
end
|
246
|
+
|
247
|
+
# Not in any included modules, check the parent
|
248
|
+
@method_cache[cache_key] = find_method(method_name, klass.parent)
|
249
|
+
end
|
250
|
+
end
|
251
|
+
|
223
252
|
def index_call_sites
|
224
253
|
finder = Brakeman::FindAllCalls.new self
|
225
254
|
|
@@ -285,8 +314,8 @@ class Brakeman::Tracker
|
|
285
314
|
method_sets.each do |set|
|
286
315
|
set.each do |set_name, info|
|
287
316
|
info.each_method do |method_name, definition|
|
288
|
-
src = definition
|
289
|
-
finder.process_source src, :class => set_name, :method => method_name, :file => definition
|
317
|
+
src = definition.src
|
318
|
+
finder.process_source src, :class => set_name, :method => method_name, :file => definition.file
|
290
319
|
end
|
291
320
|
end
|
292
321
|
end
|
data/lib/brakeman/util.rb
CHANGED
@@ -50,7 +50,11 @@ module Brakeman::Util
|
|
50
50
|
|
51
51
|
# stupid simple, used to delegate to ActiveSupport
|
52
52
|
def pluralize word
|
53
|
-
word
|
53
|
+
if word.end_with? 's'
|
54
|
+
word + 'es'
|
55
|
+
else
|
56
|
+
word + 's'
|
57
|
+
end
|
54
58
|
end
|
55
59
|
|
56
60
|
#Returns a class name as a Symbol.
|
@@ -142,6 +146,14 @@ module Brakeman::Util
|
|
142
146
|
nil
|
143
147
|
end
|
144
148
|
|
149
|
+
def hash_values hash
|
150
|
+
values = hash.each_sexp.each_slice(2).map do |_, value|
|
151
|
+
value
|
152
|
+
end
|
153
|
+
|
154
|
+
Sexp.new(:array).concat(values).line(hash.line)
|
155
|
+
end
|
156
|
+
|
145
157
|
#These are never modified
|
146
158
|
PARAMS_SEXP = Sexp.new(:params)
|
147
159
|
SESSION_SEXP = Sexp.new(:session)
|
@@ -230,30 +242,22 @@ module Brakeman::Util
|
|
230
242
|
|
231
243
|
#Check if _exp_ is a params hash
|
232
244
|
def params? exp
|
233
|
-
|
234
|
-
return true if exp.node_type == :params or ALL_PARAMETERS.include? exp
|
235
|
-
|
236
|
-
if call? exp
|
237
|
-
if params? exp[1]
|
238
|
-
return true
|
239
|
-
elsif exp[2] == :[]
|
240
|
-
return params? exp[1]
|
241
|
-
end
|
242
|
-
end
|
243
|
-
end
|
244
|
-
|
245
|
-
false
|
245
|
+
recurse_check?(exp) { |child| child.node_type == :params or ALL_PARAMETERS.include? child }
|
246
246
|
end
|
247
247
|
|
248
248
|
def cookies? exp
|
249
|
+
recurse_check?(exp) { |child| child.node_type == :cookies or ALL_COOKIES.include? child }
|
250
|
+
end
|
251
|
+
|
252
|
+
def recurse_check? exp, &check
|
249
253
|
if exp.is_a? Sexp
|
250
|
-
return true if exp
|
254
|
+
return true if yield(exp)
|
251
255
|
|
252
256
|
if call? exp
|
253
|
-
if
|
257
|
+
if recurse_check? exp[1], &check
|
254
258
|
return true
|
255
259
|
elsif exp[2] == :[]
|
256
|
-
return
|
260
|
+
return recurse_check? exp[1], &check
|
257
261
|
end
|
258
262
|
end
|
259
263
|
end
|
@@ -293,12 +297,24 @@ module Brakeman::Util
|
|
293
297
|
exp.is_a? Sexp and types.include? exp.node_type
|
294
298
|
end
|
295
299
|
|
296
|
-
|
300
|
+
SIMPLE_LITERALS = [:lit, :false, :str, :true]
|
301
|
+
|
302
|
+
def simple_literal? exp
|
303
|
+
exp.is_a? Sexp and SIMPLE_LITERALS.include? exp.node_type
|
304
|
+
end
|
305
|
+
|
306
|
+
LITERALS = [*SIMPLE_LITERALS, :array, :hash]
|
297
307
|
|
298
308
|
def literal? exp
|
299
309
|
exp.is_a? Sexp and LITERALS.include? exp.node_type
|
300
310
|
end
|
301
311
|
|
312
|
+
def all_literals? exp, expected_type = :array
|
313
|
+
node_type? exp, expected_type and
|
314
|
+
exp.length > 1 and
|
315
|
+
exp.all? { |e| e.is_a? Symbol or node_type? e, :lit, :str }
|
316
|
+
end
|
317
|
+
|
302
318
|
DIR_CONST = s(:const, :Dir)
|
303
319
|
|
304
320
|
# Dir.glob(...).whatever
|
data/lib/brakeman/version.rb
CHANGED
data/lib/brakeman.rb
CHANGED
@@ -65,6 +65,7 @@ module Brakeman
|
|
65
65
|
# * :report_routes - show found routes on controllers (default: false)
|
66
66
|
# * :run_checks - array of checks to run (run all if not specified)
|
67
67
|
# * :safe_methods - array of methods to consider safe
|
68
|
+
# * :sql_safe_methods - array of sql sanitization methods to consider safe
|
68
69
|
# * :skip_libs - do not process lib/ directory (default: false)
|
69
70
|
# * :skip_vendor - do not process vendor/ directory (default: true)
|
70
71
|
# * :skip_checks - checks not to run (run all if not specified)
|
@@ -198,6 +199,7 @@ module Brakeman
|
|
198
199
|
:relative_path => false,
|
199
200
|
:report_progress => true,
|
200
201
|
:safe_methods => Set.new,
|
202
|
+
:sql_safe_methods => Set.new,
|
201
203
|
:skip_checks => Set.new,
|
202
204
|
:skip_vendor => true,
|
203
205
|
}
|
@@ -250,6 +252,8 @@ module Brakeman
|
|
250
252
|
[:to_sarif]
|
251
253
|
when :sonar, :to_sonar
|
252
254
|
[:to_sonar]
|
255
|
+
when :github, :to_github
|
256
|
+
[:to_github]
|
253
257
|
else
|
254
258
|
[:to_text]
|
255
259
|
end
|
@@ -283,6 +287,8 @@ module Brakeman
|
|
283
287
|
:to_sarif
|
284
288
|
when /\.sonar$/i
|
285
289
|
:to_sonar
|
290
|
+
when /\.github$/i
|
291
|
+
:to_github
|
286
292
|
else
|
287
293
|
:to_text
|
288
294
|
end
|
@@ -388,7 +394,7 @@ module Brakeman
|
|
388
394
|
if options[:parallel_checks]
|
389
395
|
notify "Running checks in parallel..."
|
390
396
|
else
|
391
|
-
notify "
|
397
|
+
notify "Running checks..."
|
392
398
|
end
|
393
399
|
|
394
400
|
tracker.run_checks
|
@@ -473,7 +479,7 @@ module Brakeman
|
|
473
479
|
$stderr.puts message if @debug
|
474
480
|
end
|
475
481
|
|
476
|
-
# Compare JSON
|
482
|
+
# Compare JSON output from a previous scan and return the diff of the two scans
|
477
483
|
def self.compare options
|
478
484
|
require 'json'
|
479
485
|
require 'brakeman/differ'
|
data/lib/ruby_parser/bm_sexp.rb
CHANGED
@@ -543,6 +543,20 @@ class Sexp
|
|
543
543
|
self.body.unshift :rlist
|
544
544
|
end
|
545
545
|
|
546
|
+
# Number of "statements" in a method.
|
547
|
+
# This is more efficient than `Sexp#body.length`
|
548
|
+
# because `Sexp#body` creates a new Sexp.
|
549
|
+
def method_length
|
550
|
+
expect :defn, :defs
|
551
|
+
|
552
|
+
case self.node_type
|
553
|
+
when :defn
|
554
|
+
self.length - 3
|
555
|
+
when :defs
|
556
|
+
self.length - 4
|
557
|
+
end
|
558
|
+
end
|
559
|
+
|
546
560
|
def render_type
|
547
561
|
expect :render
|
548
562
|
self[1]
|
@@ -628,4 +642,14 @@ end
|
|
628
642
|
RUBY
|
629
643
|
end
|
630
644
|
|
645
|
+
class String
|
646
|
+
##
|
647
|
+
# This is a hack used by the lexer to sneak in line numbers at the
|
648
|
+
# identifier level. This should be MUCH smaller than making
|
649
|
+
# process_token return [value, lineno] and modifying EVERYTHING that
|
650
|
+
# reduces tIDENTIFIER.
|
651
|
+
|
652
|
+
attr_accessor :lineno
|
653
|
+
end
|
654
|
+
|
631
655
|
class WrongSexpError < RuntimeError; end
|