brakeman 5.1.0 → 5.2.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (146) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +26 -1
  3. data/README.md +1 -1
  4. data/bundle/load.rb +5 -5
  5. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/CHANGELOG.md +8 -0
  6. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/FAQ.md +0 -0
  7. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/Gemfile +0 -0
  8. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/MIT-LICENSE +0 -0
  9. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/README.md +19 -13
  10. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/REFERENCE.md +10 -3
  11. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/TODO +0 -0
  12. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/haml.gemspec +0 -0
  13. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/attribute_builder.rb +55 -0
  14. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/attribute_compiler.rb +4 -2
  15. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/attribute_parser.rb +0 -0
  16. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/buffer.rb +0 -56
  17. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/compiler.rb +0 -0
  18. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/engine.rb +0 -0
  19. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/error.rb +0 -0
  20. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/escapable.rb +0 -0
  21. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/exec.rb +0 -0
  22. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/filters.rb +0 -0
  23. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/generator.rb +0 -0
  24. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/action_view_extensions.rb +0 -0
  25. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/action_view_mods.rb +0 -0
  26. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/action_view_xss_mods.rb +0 -0
  27. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/safe_erubi_template.rb +0 -0
  28. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/safe_erubis_template.rb +0 -0
  29. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers/xss_mods.rb +0 -0
  30. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/helpers.rb +0 -0
  31. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/options.rb +0 -0
  32. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/parser.rb +0 -0
  33. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/plugin.rb +18 -1
  34. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/railtie.rb +5 -0
  35. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/sass_rails_filter.rb +0 -0
  36. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/template/options.rb +0 -0
  37. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/template.rb +0 -0
  38. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/temple_engine.rb +2 -1
  39. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/temple_line_counter.rb +0 -0
  40. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/util.rb +0 -0
  41. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml/version.rb +1 -1
  42. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/lib/haml.rb +0 -0
  43. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/yard/default/fulldoc/html/css/common.sass +0 -0
  44. data/bundle/ruby/2.7.0/gems/{haml-5.2.1 → haml-5.2.2}/yard/default/layout/html/footer.erb +0 -0
  45. data/bundle/ruby/2.7.0/gems/{parallel-1.20.1 → parallel-1.21.0}/MIT-LICENSE.txt +0 -0
  46. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/processor_count.rb +45 -0
  47. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb +4 -0
  48. data/bundle/ruby/2.7.0/gems/{parallel-1.20.1 → parallel-1.21.0}/lib/parallel.rb +52 -43
  49. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/History.rdoc +88 -0
  50. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/Manifest.txt +3 -0
  51. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/README.rdoc +1 -0
  52. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/compare/normalize.rb +6 -1
  53. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/debugging.md +0 -0
  54. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/gauntlet.md +106 -0
  55. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/rp_extensions.rb +15 -36
  56. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/rp_stringscanner.rb +33 -0
  57. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.rb +7128 -0
  58. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby20_parser.y +335 -252
  59. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.rb +7182 -0
  60. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby21_parser.y +330 -249
  61. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.rb +7228 -0
  62. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby22_parser.y +334 -251
  63. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.rb +7237 -0
  64. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby26_parser.y → ruby_parser-3.18.1/lib/ruby23_parser.y} +336 -276
  65. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.rb +7268 -0
  66. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby24_parser.y +334 -251
  67. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.rb +7268 -0
  68. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby30_parser.y → ruby_parser-3.18.1/lib/ruby25_parser.y} +335 -304
  69. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.rb +7287 -0
  70. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby27_parser.y → ruby_parser-3.18.1/lib/ruby26_parser.y} +334 -288
  71. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.rb +8517 -0
  72. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0/lib/ruby_parser.yy → ruby_parser-3.18.1/lib/ruby27_parser.y} +906 -380
  73. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.rb +8751 -0
  74. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.y +3472 -0
  75. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby3_parser.yy +3476 -0
  76. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby_lexer.rb +261 -609
  77. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby_lexer.rex +27 -20
  78. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby_lexer.rex.rb +59 -23
  79. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer_strings.rb +638 -0
  80. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby_parser.rb +0 -0
  81. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_parser.yy +3487 -0
  82. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/lib/ruby_parser_extras.rb +296 -115
  83. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.16.0 → ruby_parser-3.18.1}/tools/munge.rb +34 -6
  84. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/tools/ripper.rb +44 -0
  85. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/History.rdoc +15 -0
  86. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/Manifest.txt +0 -0
  87. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/README.rdoc +0 -0
  88. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/composite_sexp_processor.rb +0 -0
  89. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/pt_testcase.rb +7 -2
  90. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/sexp.rb +19 -9
  91. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/sexp_matcher.rb +0 -0
  92. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/sexp_processor.rb +1 -1
  93. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/strict_sexp.rb +25 -3
  94. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.15.3 → sexp_processor-4.16.0}/lib/unique.rb +0 -0
  95. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/CHANGELOG.md +4 -0
  96. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/MIT-LICENSE.txt +0 -0
  97. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/README.md +1 -1
  98. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/data/display_width.marshal.gz +0 -0
  99. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/constants.rb +2 -2
  100. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/index.rb +0 -0
  101. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/no_string_ext.rb +0 -0
  102. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width/string_ext.rb +0 -0
  103. data/bundle/ruby/2.7.0/gems/{unicode-display_width-1.7.0 → unicode-display_width-1.8.0}/lib/unicode/display_width.rb +0 -0
  104. data/lib/brakeman/app_tree.rb +1 -1
  105. data/lib/brakeman/checks/base_check.rb +10 -0
  106. data/lib/brakeman/checks/check_eol_rails.rb +23 -0
  107. data/lib/brakeman/checks/check_eol_ruby.rb +26 -0
  108. data/lib/brakeman/checks/check_json_parsing.rb +1 -1
  109. data/lib/brakeman/checks/check_sql.rb +3 -2
  110. data/lib/brakeman/checks/check_symbol_dos.rb +1 -1
  111. data/lib/brakeman/checks/eol_check.rb +47 -0
  112. data/lib/brakeman/commandline.rb +1 -1
  113. data/lib/brakeman/options.rb +8 -0
  114. data/lib/brakeman/processors/alias_processor.rb +7 -1
  115. data/lib/brakeman/processors/gem_processor.rb +3 -0
  116. data/lib/brakeman/processors/haml_template_processor.rb +9 -0
  117. data/lib/brakeman/processors/lib/call_conversion_helper.rb +2 -0
  118. data/lib/brakeman/processors/lib/rails3_route_processor.rb +2 -0
  119. data/lib/brakeman/processors/model_processor.rb +1 -0
  120. data/lib/brakeman/report/ignore/config.rb +5 -5
  121. data/lib/brakeman/report/report_csv.rb +1 -1
  122. data/lib/brakeman/report/report_sarif.rb +2 -2
  123. data/lib/brakeman/report/report_text.rb +1 -1
  124. data/lib/brakeman/scanner.rb +15 -13
  125. data/lib/brakeman/tracker/config.rb +8 -1
  126. data/lib/brakeman/version.rb +1 -1
  127. data/lib/brakeman/warning_codes.rb +4 -0
  128. data/lib/brakeman.rb +6 -8
  129. data/lib/ruby_parser/bm_sexp.rb +11 -1
  130. metadata +105 -99
  131. data/bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/processor_count.rb +0 -42
  132. data/bundle/ruby/2.7.0/gems/parallel-1.20.1/lib/parallel/version.rb +0 -3
  133. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/rp_stringscanner.rb +0 -64
  134. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby20_parser.rb +0 -7075
  135. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby21_parser.rb +0 -7148
  136. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby22_parser.rb +0 -7185
  137. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.rb +0 -7199
  138. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby23_parser.y +0 -2643
  139. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby24_parser.rb +0 -7219
  140. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.rb +0 -7218
  141. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby25_parser.y +0 -2651
  142. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby26_parser.rb +0 -7240
  143. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby27_parser.rb +0 -7358
  144. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/lib/ruby30_parser.rb +0 -7358
  145. data/bundle/ruby/2.7.0/gems/ruby_parser-3.16.0/tools/ripper.rb +0 -39
  146. data/bundle/ruby/2.7.0/gems/unicode-display_width-1.7.0/data/display_width.marshal.gz +0 -0
@@ -76,12 +76,31 @@ def munge s
76
76
 
77
77
  # other
78
78
 
79
+ 'kTERMINATOR', "tSTRING_END",
80
+ '"kTERMINATOR"', "tSTRING_END",
81
+ 'kTRCURLY', "tSTRING_DEND",
82
+
83
+ '"symbol literal"', "tSYMBEG",
84
+ '"string literal"', "tSTRING_BEG",
85
+ '"backtick literal"', "tXSTRING_BEG",
86
+ '"regexp literal"', "tREGEXP_BEG",
87
+ '"word list"', "tWORDS_BEG",
88
+ '"verbatim word list"', "tQWORDS_BEG",
89
+ '"symbol list"', "tSYMBOLS_BEG",
90
+ '"verbatim symbol list"', "tQSYMBOLS_BEG",
91
+ '"terminator"', "tSTRING_END",
92
+ '"\'}\'"', "tSTRING_DEND",
93
+
94
+ '"string literal"',"tSTRING_BEG",
95
+ '"literal content"', "tSTRING_CONTENT",
96
+ /\$/, "", # try to remove these lumps?
97
+
79
98
  'tLBRACK2', "tLBRACK", # HACK
80
99
 
81
100
  "' '", "tSPACE", # needs to be later to avoid bad hits
82
101
 
83
102
  "/* empty */", "none",
84
- /^\s*$/, "none",
103
+ /^\s*$/, "",
85
104
 
86
105
  "keyword_BEGIN", "klBEGIN",
87
106
  "keyword_END", "klEND",
@@ -89,6 +108,7 @@ def munge s
89
108
  /\bk_([a-z_]+)/, proc { "k#{$1.upcase}" },
90
109
  /modifier_(\w+)/, proc { "k#{$1.upcase}_MOD" },
91
110
  "kVARIABLE", "keyword_variable", # ugh
111
+ "tCONST", "kCONST",
92
112
 
93
113
  # 2.6 collapses klBEGIN to kBEGIN
94
114
  "klBEGIN", "kBEGIN",
@@ -112,9 +132,11 @@ def munge s
112
132
  '"do (for condition)"', "kDO_COND",
113
133
  '"do (for lambda)"', "kDO_LAMBDA",
114
134
  '"do (for block)"', "kDO_BLOCK",
135
+ '"local variable or method"', "tIDENTIFIER",
115
136
 
116
137
  /\"(\w+) \(modifier\)\"/, proc { |x| "k#{$1.upcase}_MOD" },
117
138
  /\"(\w+)\"/, proc { |x| "k#{$1.upcase}" },
139
+ /\"`(\w+)'\"/, proc { |x| "k#{$1.upcase}" },
118
140
 
119
141
  /@(\d+)(\s+|$)/, "",
120
142
  /\$?@(\d+) */, "", # TODO: remove?
@@ -130,7 +152,11 @@ def munge s
130
152
  end
131
153
  end
132
154
 
133
- s.strip.squeeze " "
155
+ if s.empty? then
156
+ nil
157
+ else
158
+ s.strip.squeeze " "
159
+ end
134
160
  end
135
161
 
136
162
  ARGF.each_line do |line|
@@ -144,19 +170,19 @@ ARGF.each_line do |line|
144
170
  when /^Reading a token: Next token is token (.*?) \(\)/ then
145
171
  token = munge $1
146
172
  next if last_token == token
147
- puts "next token is %p (%p)" % [token, last_token]
173
+ puts "next token is %p" % [token]
148
174
  last_token = token
149
175
  when /^Reading a token: / then
150
176
  next # skip
151
177
  when /^read\s+:(\w+)/ then # read :tNL(tNL) nil
152
178
  token = munge $1
153
179
  next if last_token == token
154
- puts "next token is %p (%p)" % [token, last_token]
180
+ puts "next token is %p" % [token]
155
181
  last_token = token
156
182
  when /^Next token is token ("[^"]+"|\S+)/ then
157
183
  token = munge $1
158
184
  next if last_token == token
159
- puts "next token is %p (%p)" % [token, last_token]
185
+ puts "next token is %p" % [token]
160
186
  last_token = token
161
187
  when /^read\s+false/ then # read false($end) "$end"
162
188
  puts "next token is EOF"
@@ -164,6 +190,8 @@ ARGF.each_line do |line|
164
190
  # do nothing
165
191
  when /^.:scan=>\["([^"]+)"/ then
166
192
  puts "scan = %p" % [$1]
193
+ when /^.:getch=>\["([^"]+)/ then
194
+ puts "SCAN = %p" % [$1]
167
195
  when /^Reducing stack by rule (\d+) \(line (\d+)\):/ then
168
196
  reduce_line = $2.to_i
169
197
  when /^ \$\d+ = (?:token|nterm) (.+) \(.*\)/ then
@@ -172,7 +200,7 @@ ARGF.each_line do |line|
172
200
  when /^-> \$\$ = (?:token|nterm) (.+) \(.*\)/ then
173
201
  stack << "none" if stack.empty?
174
202
  item = munge $1
175
- x = stack.map { |s| s.strip }.join " "
203
+ x = stack.compact.map { |s| munge s.strip }.compact.join " "
176
204
  if x != item then # prevent kdef -> kdef
177
205
  if $v && reduce_line then
178
206
  puts "reduce #{x} --> #{item} at #{reduce_line}".squeeze " "
@@ -0,0 +1,44 @@
1
+ #!/usr/bin/env ruby -ws
2
+
3
+ $b ||= false # bug mode -- ripper is buggy, use Ripper.sexp
4
+ $d ||= false # debug -- turn on yydebug
5
+ $p ||= false # Use pp
6
+
7
+ require "ripper/sexp"
8
+ require "pp" if $p
9
+
10
+ if ARGV.empty? then
11
+ warn "reading from stdin"
12
+ ARGV << "-"
13
+ end
14
+
15
+ class MySexpBuilder < Ripper::SexpBuilderPP
16
+ def on_parse_error msg
17
+ Kernel.warn msg
18
+ end
19
+ end
20
+
21
+ ARGV.each do |path|
22
+ src = path == "-" ? $stdin.read : File.read(path)
23
+
24
+ sexp = if $b then
25
+ Ripper.sexp src
26
+ else
27
+ rip = MySexpBuilder.new src
28
+ rip.yydebug = $d
29
+ rip.parse
30
+
31
+ if rip.error? then
32
+ warn "skipping"
33
+ next
34
+ end
35
+ end
36
+
37
+ puts "accept"
38
+
39
+ if $p then
40
+ pp sexp
41
+ else
42
+ p sexp
43
+ end
44
+ end
@@ -1,3 +1,18 @@
1
+ === 4.16.0 / 2021-10-27
2
+
3
+ * 4 minor enhancements:
4
+
5
+ * Added Sexp#value (pushed up from ruby_parser).
6
+ * Aliased Sexp#concat to #_concat and use that so it can be overridden.
7
+ * Cache the #hash result.
8
+ * StrictSexp mode (4) now covers concat.
9
+
10
+ * 3 bug fixes:
11
+
12
+ * Fix some doco on each_sexp to clarify that it is not recursive.
13
+ * Fixed a bug calling enum_for when using each_of_type w/ no block.
14
+ * Minor fixes to pt_testcase.rb for custom timeouts and better error handling.
15
+
1
16
  === 4.15.3 / 2021-05-15
2
17
 
3
18
  * 1 minor enhancement:
@@ -150,7 +150,8 @@ class ParseTreeTestCase < Minitest::Test
150
150
 
151
151
  before_process_hook klass, node, data, input_name, output_name
152
152
  refute_nil data[input_name], "testcase does not exist?"
153
- @result = processor.process input
153
+ timeout = (ENV["RP_TIMEOUT"] || 10).to_i
154
+ @result = processor.process input, "(string)", timeout
154
155
  assert_equal(expected, @result,
155
156
  "failed on input: #{data[input_name].inspect}")
156
157
  after_process_hook klass, node, data, input_name, output_name
@@ -158,7 +159,11 @@ class ParseTreeTestCase < Minitest::Test
158
159
  extra_input.each do |extra|
159
160
  processor.process(extra)
160
161
  end
161
- extra = processor.extra_methods rescue []
162
+ extra = if processor.respond_to?(:extra_methods) then
163
+ processor.extra_methods
164
+ else
165
+ []
166
+ end
162
167
  assert_equal extra_expected, extra
163
168
  end
164
169
  end
@@ -31,13 +31,15 @@ class Sexp < Array # ZenTest FULL
31
31
  super(args)
32
32
  end
33
33
 
34
+ alias _concat concat
35
+
34
36
  ##
35
37
  # Creates a new Sexp from Array +a+.
36
38
 
37
39
  def self.from_array a
38
40
  ary = Array === a ? a : [a]
39
41
 
40
- self.new.concat(ary.map { |x|
42
+ self.new._concat(ary.map { |x|
41
43
  case x
42
44
  when Sexp
43
45
  x
@@ -54,7 +56,7 @@ class Sexp < Array # ZenTest FULL
54
56
  # same +file+, +line+, and +comment+ as self.
55
57
 
56
58
  def new(*body)
57
- r = self.class.new.concat(body) # ensures a sexp from map
59
+ r = self.class.new._concat(body) # ensures a sexp from map
58
60
  r.file = self.file if self.file
59
61
  r.line = self.line if self.line
60
62
  r.comments = self.comments if self.comments
@@ -62,7 +64,7 @@ class Sexp < Array # ZenTest FULL
62
64
  end
63
65
 
64
66
  def map &blk # :nodoc:
65
- self.new.concat(super(&blk)) # ensures a sexp from map
67
+ self.new._concat(super(&blk)) # ensures a sexp from map
66
68
  end
67
69
 
68
70
  def == obj # :nodoc:
@@ -74,7 +76,7 @@ class Sexp < Array # ZenTest FULL
74
76
  end
75
77
 
76
78
  def hash
77
- [self.class, *self].hash
79
+ @hash ||= [self.class, *self].hash
78
80
  end
79
81
 
80
82
  ##
@@ -93,7 +95,7 @@ class Sexp < Array # ZenTest FULL
93
95
  end
94
96
 
95
97
  ##
96
- # Recursively enumerates the sexp yielding to +block+ for every element.
98
+ # Recursively enumerates the sexp yielding to +block+ for every sub-Sexp.
97
99
  #
98
100
  # Returning :skip will stop traversing that subtree:
99
101
  #
@@ -122,7 +124,7 @@ class Sexp < Array # ZenTest FULL
122
124
  # Enumeratates the sexp yielding to +b+ when the node_type == +t+.
123
125
 
124
126
  def each_of_type t, &b
125
- return enum_for(:each_of_type) unless block_given?
127
+ return enum_for(:each_of_type, t) unless block_given?
126
128
 
127
129
  each_sexp do | sexp |
128
130
  sexp.each_of_type(t, &b)
@@ -131,7 +133,7 @@ class Sexp < Array # ZenTest FULL
131
133
  end
132
134
 
133
135
  ##
134
- # Recursively enumerates all sub-sexps skipping non-Sexp elements.
136
+ # Enumerates all sub-sexps skipping non-Sexp elements.
135
137
 
136
138
  def each_sexp
137
139
  return enum_for(:each_sexp) unless block_given?
@@ -289,11 +291,11 @@ class Sexp < Array # ZenTest FULL
289
291
  # the values without the node type.
290
292
 
291
293
  def sexp_body from = 1
292
- self.new.concat(self[from..-1] || [])
294
+ self.new._concat(self[from..-1] || [])
293
295
  end
294
296
 
295
297
  ##
296
- # Returns the Sexp body, ie the values without the node type.
298
+ # Sets the Sexp body to new content.
297
299
 
298
300
  def sexp_body= v
299
301
  self[1..-1] = v
@@ -362,6 +364,14 @@ class Sexp < Array # ZenTest FULL
362
364
  end
363
365
 
364
366
  alias to_s inspect # :nodoc:
367
+
368
+ ##
369
+ # Return the value (last item) of a single element sexp (eg `s(:lit, 42)`).
370
+
371
+ def value
372
+ raise "multi item sexp" if size > 2
373
+ last
374
+ end
365
375
  end
366
376
 
367
377
  ##
@@ -34,7 +34,7 @@ require "sexp"
34
34
  class SexpProcessor
35
35
 
36
36
  # duh
37
- VERSION = "4.15.3"
37
+ VERSION = "4.16.0"
38
38
 
39
39
  ##
40
40
  # Automatically shifts off the Sexp type before handing the
@@ -36,6 +36,7 @@
36
36
  # 4 = sexp << => no
37
37
 
38
38
  class Sexp
39
+ # alias :_concat :concat in sexp.rb so we have access to the original
39
40
  alias :safe_idx :[]
40
41
  alias :safe_asgn :[]=
41
42
  alias :sexp_type= :sexp_type=
@@ -43,9 +44,10 @@ class Sexp
43
44
  alias :shift :shift
44
45
 
45
46
  def self.nuke_method name, level
47
+ return unless __strict >= level
46
48
  define_method name do |*args|
47
49
  raise "no mutation allowed on sexps: %s.%s %s" % [self, name, args]
48
- end if __strict >= level
50
+ end
49
51
  end
50
52
 
51
53
  def self.__strict
@@ -87,7 +89,7 @@ class Sexp
87
89
 
88
90
  nuke_method :collect!, 4
89
91
  nuke_method :compact!, 4
90
- # nuke_method :concat, 4 # HACK: using self.class.new.concat(...) for speed
92
+ nuke_method :concat, 4 # HACK: using self.class.new.concat(...) for speed
91
93
  nuke_method :flatten!, 4
92
94
  nuke_method :map!, 4
93
95
  nuke_method :pop, 4
@@ -111,7 +113,7 @@ class Sexp
111
113
  end
112
114
 
113
115
  def sexp_body from = 1
114
- self.new.concat(safe_idx(from..-1) || [])
116
+ self.new._concat(safe_idx(from..-1) || [])
115
117
  end
116
118
 
117
119
  def sexp_type= v
@@ -123,4 +125,24 @@ class Sexp
123
125
  end
124
126
  end unless Sexp.new.respond_to? :safe_asgn if ENV["STRICT_SEXP"]
125
127
 
128
+ if ENV["SP_DEBUG"] && !ENV["STRICT_SEXP"] then
129
+ class Sexp
130
+ mutators = %i[
131
+ []= clear collect! compact! concat delete delete_at
132
+ delete_if drop drop_while fill flatten! replace insert
133
+ keep_if map! pop push reject! reverse! rotate! select!
134
+ shift shuffle! slice! sort! sort_by! transpose uniq!
135
+ unshift
136
+ ]
137
+
138
+ mutators.each do |method|
139
+ define_method method do |*|
140
+ warn "Sexp modified by %p at %s" % [__method__, caller.first] if
141
+ $VERBOSE or (defined?(@hash) and @hash)
142
+ super
143
+ end
144
+ end
145
+ end
146
+ end
147
+
126
148
  # :startdoc:
@@ -1,5 +1,9 @@
1
1
  # CHANGELOG
2
2
 
3
+ ## 1.8.0
4
+
5
+ - Unicode 14.0 (last release of 1.x)
6
+
3
7
  ## 1.7.0
4
8
 
5
9
  - Unicode 13
@@ -2,7 +2,7 @@
2
2
 
3
3
  Determines the monospace display width of a string in Ruby. Implementation based on [EastAsianWidth.txt](https://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt) and other data, 100% in Ruby. Other than [wcwidth()](https://github.com/janlelis/wcswidth-ruby), which fulfills a similar purpose, it does not rely on the OS vendor to provide an up-to-date method for measuring string width.
4
4
 
5
- Unicode version: **13.0.0** (March 2020)
5
+ Unicode version: **14.0.0** (September 2021)
6
6
 
7
7
  Supported Rubies: **2.7**, **2.6**, **2.5**, **2.4**
8
8
 
@@ -1,7 +1,7 @@
1
1
  module Unicode
2
2
  module DisplayWidth
3
- VERSION = '1.7.0'
4
- UNICODE_VERSION = "13.0.0".freeze
3
+ VERSION = '1.8.0'
4
+ UNICODE_VERSION = "14.0.0"
5
5
  DATA_DIRECTORY = File.expand_path(File.dirname(__FILE__) + '/../../../data/').freeze
6
6
  INDEX_FILENAME = (DATA_DIRECTORY + '/display_width.marshal.gz').freeze
7
7
  end
@@ -28,7 +28,7 @@ module Brakeman
28
28
  # Accepts an array of filenames and paths with the following format and
29
29
  # returns a Regexp to match them:
30
30
  # * "path1/file1.rb" - Matches a specific filename in the project directory.
31
- # * "path1/" - Matches any path that conatains "path1" in the project directory.
31
+ # * "path1/" - Matches any path that contains "path1" in the project directory.
32
32
  # * "/path1/ - Matches any path that is rooted at "path1" in the project directory.
33
33
  #
34
34
  def self.regex_for_paths(paths)
@@ -513,4 +513,14 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
513
513
  string_building? exp.target or
514
514
  string_building? exp.first_arg
515
515
  end
516
+
517
+ I18N_CLASS = s(:const, :I18n)
518
+
519
+ def locale_call? exp
520
+ return unless call? exp
521
+
522
+ (exp.target == I18N_CLASS and
523
+ exp.method == :locale) or
524
+ locale_call? exp.target
525
+ end
516
526
  end
@@ -0,0 +1,23 @@
1
+ require_relative 'eol_check'
2
+
3
+ class Brakeman::CheckEOLRails < Brakeman::EOLCheck
4
+ Brakeman::Checks.add self
5
+
6
+ @description = "Checks for unsupported versions of Rails"
7
+
8
+ def run_check
9
+ return unless tracker.config.rails_version
10
+
11
+ check_eol_version :rails, RAILS_EOL_DATES
12
+ end
13
+
14
+ RAILS_EOL_DATES = {
15
+ ['2.0.0', '2.3.99'] => Date.new(2013, 6, 25),
16
+ ['3.0.0', '3.2.99'] => Date.new(2016, 6, 30),
17
+ ['4.0.0', '4.2.99'] => Date.new(2017, 4, 27),
18
+ ['5.0.0', '5.0.99'] => Date.new(2018, 5, 9),
19
+ ['5.1.0', '5.1.99'] => Date.new(2019, 8, 25),
20
+ ['5.2.0', '5.2.99'] => Date.new(2022, 6, 1),
21
+ ['6.0.0', '6.0.99'] => Date.new(2023, 6, 1),
22
+ }
23
+ end
@@ -0,0 +1,26 @@
1
+ require_relative 'eol_check'
2
+
3
+ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
4
+ Brakeman::Checks.add self
5
+
6
+ @description = "Checks for unsupported versions of Ruby"
7
+
8
+ def run_check
9
+ return unless tracker.config.ruby_version
10
+
11
+ check_eol_version :ruby, RUBY_EOL_DATES
12
+ end
13
+
14
+ RUBY_EOL_DATES = {
15
+ ['0.0.0', '1.9.3'] => Date.new(2015, 2, 23),
16
+ ['2.0.0', '2.0.99'] => Date.new(2016, 2, 24),
17
+ ['2.1.0', '2.1.99'] => Date.new(2017, 3, 31),
18
+ ['2.2.0', '2.2.99'] => Date.new(2018, 3, 31),
19
+ ['2.3.0', '2.3.99'] => Date.new(2019, 3, 31),
20
+ ['2.4.0', '2.4.99'] => Date.new(2020, 3, 31),
21
+ ['2.5.0', '2.5.99'] => Date.new(2021, 3, 31),
22
+ ['2.6.0', '2.6.99'] => Date.new(2022, 3, 31),
23
+ ['2.7.0', '2.7.99'] => Date.new(2023, 3, 31),
24
+ ['3.0.0', '2.8.99'] => Date.new(2024, 3, 31),
25
+ }
26
+ end
@@ -74,7 +74,7 @@ class Brakeman::CheckJSONParsing < Brakeman::BaseCheck
74
74
  warning_type = "Denial of Service"
75
75
  confidence = :medium
76
76
  gem_name = "#{name} gem"
77
- message = msg(msg_version(version, gem_name), " has a symbol creation vulnerablity. Upgrade to ")
77
+ message = msg(msg_version(version, gem_name), " has a symbol creation vulnerability. Upgrade to ")
78
78
 
79
79
  if version >= "1.7.0"
80
80
  confidence = :high
@@ -584,7 +584,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
584
584
  end
585
585
 
586
586
  IGNORE_METHODS_IN_SQL = Set[:id, :merge_conditions, :table_name, :quoted_table_name,
587
- :quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array, :sanitize_sql_like,
587
+ :quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array,
588
588
  :sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
589
589
  :sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
590
590
  :to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
@@ -628,7 +628,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
628
628
  arel? exp or
629
629
  exp.method.to_s.end_with? "_id" or
630
630
  number_target? exp or
631
- date_target? exp
631
+ date_target? exp or
632
+ locale_call? exp
632
633
  end
633
634
 
634
635
  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
@@ -9,7 +9,7 @@ class Brakeman::CheckSymbolDoS < Brakeman::BaseCheck
9
9
 
10
10
  def run_check
11
11
  return if rails_version and rails_version >= "5.0.0"
12
- return if tracker.config.ruby_version >= "2.2"
12
+ return if tracker.config.ruby_version and tracker.config.ruby_version >= "2.2"
13
13
 
14
14
  tracker.find_call(:methods => UNSAFE_METHODS, :nested => true).each do |result|
15
15
  check_unsafe_symbol_creation(result)
@@ -0,0 +1,47 @@
1
+ require 'date'
2
+ require 'brakeman/checks/base_check'
3
+
4
+ # Not used directly - base check for EOLRails and EOLRuby
5
+ class Brakeman::EOLCheck < Brakeman::BaseCheck
6
+ def check_eol_version library, eol_dates
7
+ version = case library
8
+ when :rails
9
+ tracker.config.rails_version
10
+ when :ruby
11
+ tracker.config.ruby_version
12
+ else
13
+ raise 'Implement using tracker.config.gem_version'
14
+ end
15
+
16
+ eol_dates.each do |(start_version, end_version), eol_date|
17
+ if version_between? start_version, end_version, version
18
+ case
19
+ when Date.today >= eol_date
20
+ warn_about_unsupported_version library, eol_date, version
21
+ when (Date.today + 30) >= eol_date
22
+ warn_about_soon_unsupported_version library, eol_date, version, :medium
23
+ when (Date.today + 60) >= eol_date
24
+ warn_about_soon_unsupported_version library, eol_date, version, :low
25
+ end
26
+
27
+ break
28
+ end
29
+ end
30
+ end
31
+
32
+ def warn_about_soon_unsupported_version library, eol_date, version, confidence
33
+ warn warning_type: 'Unmaintained Dependency',
34
+ warning_code: :"pending_eol_#{library}",
35
+ message: msg("Support for ", msg_version(version, library.capitalize), " ends on #{eol_date}"),
36
+ confidence: confidence,
37
+ gem_info: gemfile_or_environment
38
+ end
39
+
40
+ def warn_about_unsupported_version library, eol_date, version
41
+ warn warning_type: 'Unmaintained Dependency',
42
+ warning_code: :"eol_#{library}",
43
+ message: msg("Support for ", msg_version(version, library.capitalize), " ended on #{eol_date}"),
44
+ confidence: :high,
45
+ gem_info: gemfile_or_environment
46
+ end
47
+ end
@@ -126,7 +126,7 @@ module Brakeman
126
126
 
127
127
  ensure_ignore_notes_failed = false
128
128
  if tracker.options[:ensure_ignore_notes]
129
- fingerprints = Brakeman::ignore_file_entries_with_empty_notes tracker.ignored_filter&.file, options
129
+ fingerprints = Brakeman::ignore_file_entries_with_empty_notes tracker.ignored_filter&.file
130
130
 
131
131
  unless fingerprints.empty?
132
132
  ensure_ignore_notes_failed = true
@@ -93,6 +93,14 @@ module Brakeman::Options
93
93
  options[:rails6] = true
94
94
  end
95
95
 
96
+ opts.on "-7", "--rails7", "Force Rails 7 mode" do
97
+ options[:rails3] = true
98
+ options[:rails4] = true
99
+ options[:rails5] = true
100
+ options[:rails6] = true
101
+ options[:rails7] = true
102
+ end
103
+
96
104
  opts.separator ""
97
105
  opts.separator "Scanning options:"
98
106
 
@@ -324,7 +324,13 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
324
324
  end
325
325
  when :values_at
326
326
  if node_type? target, :hash
327
- exp = hash_values_at target, exp.args
327
+ res = hash_values_at target, exp.args
328
+
329
+ # Only convert to array of values if _all_ keys
330
+ # are present in the hash.
331
+ unless res.any?(&:nil?)
332
+ exp = res
333
+ end
328
334
  end
329
335
  end
330
336
 
@@ -6,6 +6,7 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
6
6
  def initialize *args
7
7
  super
8
8
  @gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
9
+ @ruby_version = /^\s+ruby (\d\.\d.\d+)/
9
10
  end
10
11
 
11
12
  def process_gems gem_files
@@ -95,6 +96,8 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
95
96
  def set_gem_version_and_file line, file, line_num
96
97
  if line =~ @gem_name_version
97
98
  @tracker.config.add_gem $1, $2, file, line_num
99
+ elsif line =~ @ruby_version
100
+ @tracker.config.set_ruby_version $1
98
101
  end
99
102
  end
100
103
  end