brakeman 5.1.2 → 5.2.2

data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.0 → ruby_parser-3.19.1}/lib/ruby_parser.rb

@@ -80,10 +80,12 @@ require "ruby25_parser"
 require "ruby26_parser"
 require "ruby27_parser"
 require "ruby30_parser"
+require "ruby31_parser"
 
 class RubyParser # HACK
   VERSIONS.clear # also a HACK caused by racc namespace issues
 
+  class V31 < ::Ruby31Parser; end
   class V30 < ::Ruby30Parser; end
   class V27 < ::Ruby27Parser; end
   class V26 < ::Ruby26Parser; end

data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.0 → ruby_parser-3.19.1}/lib/ruby_parser.yy

@@ -767,8 +767,7 @@ rule
 
            cpath: tCOLON3 cname
                     {
-                      _, (name, line) = val
-                      result = s(:colon3, name.to_sym).line line
+                      result = wrap :colon3, val[1]
                     }
                 | cname
                     {
@@ -793,9 +792,7 @@ rule
 
            fitem: fname
                     {
-                      (id, line), = val
-
-                      result = s(:lit, id.to_sym).line line
+                      result = wrap :lit, val[0]
                     }
                 | symbol
 
@@ -864,9 +861,9 @@ rule
                     }
                 | tCOLON3 tCONSTANT tOP_ASGN arg_rhs
                     {
-                      _, (lhs, line), op, rhs = val
+                      _, lhs, op, rhs = val
 
-                      lhs = s(:colon3, lhs.to_sym).line line
+                      lhs = wrap :colon3, lhs
                       result = new_const_op_asgn [lhs, op, rhs]
                     }
                 | backref tOP_ASGN arg_rhs
@@ -1336,9 +1333,7 @@ rule
                     }
                 | tCOLON3 tCONSTANT
                     {
-                      _, (id, line) = val
-
-                      result = s(:colon3, id.to_sym).line line
+                      result = wrap :colon3, val[1]
                     }
                 | tLBRACK { result = lexer.lineno } aref_args tRBRACK
                     {
@@ -1362,15 +1357,21 @@ rule
                     }
                 | kYIELD tLPAREN2 call_args rparen
                     {
-                      result = new_yield val[2]
+                      (_, line), _, args, _ = val
+
+                      result = new_yield(args).line line
                     }
                 | kYIELD tLPAREN2 rparen
                     {
-                      result = new_yield
+                      (_, line), _, _ = val
+
+                      result = new_yield.line line
                     }
                 | kYIELD
                     {
-                      result = new_yield
+                      (_, line), = val
+
+                      result = new_yield.line line
                     }
                 | kDEFINED opt_nl tLPAREN2 expr rparen
                     {
@@ -1840,8 +1841,7 @@ opt_block_args_tail: tCOMMA block_args_tail
 
             bvar: tIDENTIFIER
                     {
-                      (id, line), = val
-                      result = s(:shadow, id.to_sym).line line
+                      result = wrap :shadow, val[0]
                     }
                 | f_bad_arg
 
@@ -2452,9 +2452,7 @@ opt_block_args_tail: tCOMMA block_args_tail
 
       p_kw_label: tLABEL
                     {
-                      (id, line), = val
-
-                      result = s(:lit, id.to_sym).line line
+                      result = wrap :lit, val[0]
                     }
 
         p_kwrest: kwrest_mark tIDENTIFIER
@@ -2546,26 +2544,20 @@ opt_block_args_tail: tCOMMA block_args_tail
 
       p_variable: tIDENTIFIER
                     {
-                      (id, line), = val
-
                       # TODO: error_duplicate_pattern_variable(p, $1, &@1);
                       # TODO: assignable(p, $1, 0, &@$);
-                      result = s(:lvar, id.to_sym).line line
+                      result = wrap :lvar, val[0]
                     }
 
        p_var_ref: tCARET tIDENTIFIER
                     {
-                      _, (id, line) = val
-
                       # TODO: check id against env for lvar or dvar
-
-                      result = s(:lvar, id.to_sym).line line
+                      result = wrap :lvar, val[1]
                     }
 
          p_const: tCOLON3 cname
                     {
-                      _, (id, line) = val
-                      result = s(:colon3, id.to_sym).line line
+                      result = wrap :colon3, val[1]
                     }
                 | p_const tCOLON2 cname
                     {
@@ -2577,8 +2569,7 @@ opt_block_args_tail: tCOMMA block_args_tail
                 | tCONSTANT
                     {
                       # TODO $$ = gettable(p, $1, &@$);
-                      (id, line), = val
-                      result = s(:const, id.to_sym).line line
+                      result = wrap :const, val[0]
                     }
 ######################################################################
 #endif
@@ -2865,18 +2856,15 @@ regexp_contents: none
 
      string_dvar: tGVAR
                     {
-                      (id, line), = val
-                      result = s(:gvar, id.to_sym).line line
+                      result = wrap :gvar, val[0]
                     }
                 | tIVAR
                     {
-                      (id, line), = val
-                      result = s(:ivar, id.to_sym).line line
+                      result = wrap :ivar, val[0]
                     }
                 | tCVAR
                     {
-                      (id, line), = val
-                      result = s(:cvar, id.to_sym).line line
+                      result = wrap :cvar, val[0]
                     }
                 | backref
 
@@ -2885,17 +2873,13 @@ regexp_contents: none
 
             ssym: tSYMBEG sym
                     {
-                      _, (id, line) = val
-
                       lexer.lex_state = EXPR_END
-                      result = s(:lit, id.to_sym).line line
+                      result = wrap :lit, val[1]
                     }
                 | tSYMBOL
                     {
-                      (id, line), = val
-
                       lexer.lex_state = EXPR_END
-                      result = s(:lit, id.to_sym).line line
+                      result = wrap :lit, val[0]
                     }
 
              sym: fname | tIVAR | tGVAR | tCVAR
@@ -3416,10 +3400,10 @@ keyword_variable: kNIL      { result = s(:nil).line lexer.lineno }
                     }
                 | tLABEL arg_value
                     {
-                      (label, line), arg = val
+                      label, arg = val
 
-                      lit = s(:lit, label.to_sym).line line
-                      result = s(:array, lit, arg).line line
+                      lit = wrap :lit, label
+                      result = s(:array, lit, arg).line lit.line
                     }
 #if V >= 22
                 | tSTRING_BEG string_contents tLABEL_END arg_value

data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.0 → ruby_parser-3.19.1}/lib/ruby_parser_extras.rb

@@ -30,7 +30,7 @@ class Sexp
 end
 
 module RubyParserStuff
-  VERSION = "3.18.0"
+  VERSION = "3.19.1"
 
   attr_accessor :lexer, :in_def, :in_single, :file
   attr_accessor :in_kwarg
@@ -218,11 +218,15 @@ module RubyParserStuff
     self.args args
   end
 
+  def attrset_id? id
+    id =~ /^\[\]=$|^\w+=$/
+  end
+
   def endless_method_name defn_or_defs
     name = defn_or_defs[1]
     name = defn_or_defs[2] unless Symbol === name
 
-    if name.end_with? "=" then
+    if attrset_id? name then
       yyerror "setter method cannot be defined in an endless method definition"
     end
 
@@ -978,6 +982,49 @@ module RubyParserStuff
     [result, in_def]
   end
 
+  def new_endless_defn val
+    (name, line, in_def), args, _, body, _, resbody = val
+
+    result =
+      if resbody then
+        s(:defn, name, args,
+          new_rescue(body,
+                     new_resbody(s(:array).line(line),
+                                 resbody))).line line
+      else
+        s(:defn, name, args, body).line line
+      end
+
+    local_pop in_def
+    endless_method_name result
+
+    result.comments = self.comments.pop
+
+    result
+  end
+
+  def new_endless_defs val
+    (recv, (name, line, in_def)), args, _, body, _, resbody = val
+
+    result =
+      if resbody then
+        s(:defs, recv, name, args,
+          new_rescue(body,
+                     new_resbody(s(:array).line(line),
+                                 resbody))).line line
+      else
+        s(:defs, recv, name, args, body).line(line)
+      end
+
+    self.in_single -= 1
+    local_pop in_def
+    endless_method_name result
+
+    result.comments = self.comments.pop
+
+    result
+  end
+
   def new_defs val
     _, recv, (name, line), in_def, args, body, _ = val
 
@@ -1613,6 +1660,12 @@ module RubyParserStuff
 
   alias remove_whitespace_width whitespace_width
 
+  def wrap type, node
+    value, line = node
+    value = value.to_sym if value.respond_to? :to_sym
+    s(type, value).line line
+  end
+
   class Keyword
     include RubyLexer::State::Values
 

data/lib/brakeman/checks/base_check.rb

@@ -513,4 +513,14 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
     string_building? exp.target or
     string_building? exp.first_arg
   end
+
+  I18N_CLASS = s(:const, :I18n)
+
+  def locale_call? exp
+    return unless call? exp
+
+    (exp.target == I18N_CLASS and
+     exp.method == :locale) or
+    locale_call? exp.target
+  end
 end

data/lib/brakeman/checks/check_eol_rails.rb

@@ -0,0 +1,23 @@
+require_relative 'eol_check'
+
+class Brakeman::CheckEOLRails < Brakeman::EOLCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for unsupported versions of Rails"
+
+  def run_check
+    return unless tracker.config.rails_version
+
+    check_eol_version :rails, RAILS_EOL_DATES
+  end
+
+  RAILS_EOL_DATES = {
+    ['2.0.0', '2.3.99'] => Date.new(2013, 6, 25),
+    ['3.0.0', '3.2.99'] => Date.new(2016, 6, 30),
+    ['4.0.0', '4.2.99'] => Date.new(2017, 4, 27),
+    ['5.0.0', '5.0.99'] => Date.new(2018, 5, 9),
+    ['5.1.0', '5.1.99'] => Date.new(2019, 8, 25),
+    ['5.2.0', '5.2.99'] => Date.new(2022, 6, 1),
+    ['6.0.0', '6.0.99'] => Date.new(2023, 6, 1),
+  }
+end

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -0,0 +1,26 @@
+require_relative 'eol_check'
+
+class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
+  Brakeman::Checks.add self
+
+  @description = "Checks for unsupported versions of Ruby"
+
+  def run_check
+    return unless tracker.config.ruby_version
+
+    check_eol_version :ruby, RUBY_EOL_DATES
+  end
+
+  RUBY_EOL_DATES = {
+    ['0.0.0', '1.9.3'] => Date.new(2015, 2, 23),
+    ['2.0.0', '2.0.99'] => Date.new(2016, 2, 24),
+    ['2.1.0', '2.1.99'] => Date.new(2017, 3, 31),
+    ['2.2.0', '2.2.99'] => Date.new(2018, 3, 31),
+    ['2.3.0', '2.3.99'] => Date.new(2019, 3, 31),
+    ['2.4.0', '2.4.99'] => Date.new(2020, 3, 31),
+    ['2.5.0', '2.5.99'] => Date.new(2021, 3, 31),
+    ['2.6.0', '2.6.99'] => Date.new(2022, 3, 31),
+    ['2.7.0', '2.7.99'] => Date.new(2023, 3, 31),
+    ['3.0.0', '2.8.99'] => Date.new(2024, 3, 31),
+  }
+end

data/lib/brakeman/checks/check_sql.rb

@@ -405,7 +405,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     nil
   end
 
-  TO_STRING_METHODS = [:chomp, :to_s, :squish, :strip, :strip_heredoc]
+  TO_STRING_METHODS = [:chomp, :chop, :lstrip, :rstrip, :scrub, :squish, :strip,
+                       :strip_heredoc, :to_s, :tr]
 
   #Returns value if interpolated value is not something safe
   def unsafe_string_interp? exp
@@ -584,7 +585,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
   end
 
   IGNORE_METHODS_IN_SQL = Set[:id, :merge_conditions, :table_name, :quoted_table_name,
-    :quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array, :sanitize_sql_like,
+    :quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array,
     :sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
     :sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
     :to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
@@ -628,7 +629,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
       arel? exp or
       exp.method.to_s.end_with? "_id" or
       number_target? exp or
-      date_target? exp
+      date_target? exp or
+      locale_call? exp
   end
 
   QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
@@ -743,6 +745,6 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
       date_target? exp.target
     else
      false
-    end 
+    end
   end
 end

data/lib/brakeman/checks/check_symbol_dos.rb

@@ -9,7 +9,7 @@ class Brakeman::CheckSymbolDoS < Brakeman::BaseCheck
 
   def run_check
     return if rails_version and rails_version >= "5.0.0"
-    return if tracker.config.ruby_version >= "2.2"
+    return if tracker.config.ruby_version and tracker.config.ruby_version >= "2.2"
 
     tracker.find_call(:methods => UNSAFE_METHODS, :nested => true).each do |result|
       check_unsafe_symbol_creation(result)

data/lib/brakeman/checks/check_unsafe_reflection.rb

@@ -20,7 +20,7 @@ class Brakeman::CheckUnsafeReflection < Brakeman::BaseCheck
   def check_unsafe_reflection result
     return unless original? result
 
-    call = result[:call] 
+    call = result[:call]
     method = call.method
 
     case method
@@ -37,7 +37,12 @@ class Brakeman::CheckUnsafeReflection < Brakeman::BaseCheck
     end
 
     if confidence
-      message = msg("Unsafe reflection method ", msg_code(method), " called with ", msg_input(input))
+      case method
+      when :constantize, :safe_constantize
+        message = msg("Unsafe reflection method ", msg_code(method), " called on ", msg_input(input))
+      else
+        message = msg("Unsafe reflection method ", msg_code(method), " called with ", msg_input(input))
+      end
 
       warn :result => result,
         :warning_type => "Remote Code Execution",

data/lib/brakeman/checks/eol_check.rb

@@ -0,0 +1,47 @@
+require 'date'
+require 'brakeman/checks/base_check'
+
+# Not used directly - base check for EOLRails and EOLRuby
+class Brakeman::EOLCheck < Brakeman::BaseCheck
+  def check_eol_version library, eol_dates
+    version = case library
+              when :rails
+                tracker.config.rails_version
+              when :ruby
+                tracker.config.ruby_version
+              else
+                raise 'Implement using tracker.config.gem_version'
+              end
+
+    eol_dates.each do |(start_version, end_version), eol_date|
+      if version_between? start_version, end_version, version
+        case
+        when Date.today >= eol_date
+          warn_about_unsupported_version library, eol_date, version
+        when (Date.today + 30) >= eol_date
+          warn_about_soon_unsupported_version library, eol_date, version, :medium
+        when (Date.today + 60) >= eol_date
+          warn_about_soon_unsupported_version library, eol_date, version, :low
+        end
+
+        break
+      end
+    end
+  end
+
+  def warn_about_soon_unsupported_version library, eol_date, version, confidence
+    warn warning_type: 'Unmaintained Dependency',
+      warning_code: :"pending_eol_#{library}",
+      message: msg("Support for ", msg_version(version, library.capitalize), " ends on #{eol_date}"),
+      confidence: confidence,
+      gem_info: gemfile_or_environment
+  end
+
+  def warn_about_unsupported_version library, eol_date, version
+    warn warning_type: 'Unmaintained Dependency',
+      warning_code: :"eol_#{library}",
+      message: msg("Support for ", msg_version(version, library.capitalize), " ended on #{eol_date}"),
+      confidence: :high,
+      gem_info: gemfile_or_environment
+  end
+end

data/lib/brakeman/options.rb

@@ -93,6 +93,14 @@ module Brakeman::Options
           options[:rails6] = true
         end
 
+        opts.on "-7", "--rails7", "Force Rails 7 mode" do
+          options[:rails3] = true
+          options[:rails4] = true
+          options[:rails5] = true
+          options[:rails6] = true
+          options[:rails7] = true
+        end
+
         opts.separator ""
         opts.separator "Scanning options:"
 

data/lib/brakeman/processors/alias_processor.rb

@@ -404,7 +404,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   end
 
   def join_item item, join_value
-    if item.is_a? String
+    if item.nil? || item.is_a?(String)
       "#{item}#{join_value}"
     elsif string? item or symbol? item or number? item
       s(:str, "#{item.value}#{join_value}").line(item.line)
@@ -864,6 +864,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     elsif false? condition
       no_branch = true
       exps = [nil, exp.else_clause]
+    elsif equality_check? condition and condition.target == condition.first_arg
+      no_branch = true
+      exps = [exp.then_clause, nil]
     else
       no_branch = false
       exps = [exp.then_clause, exp.else_clause]
@@ -897,6 +900,14 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
             env.current[var] = safe_literal(var.line)
             exp[branch_index] = process_if_branch branch
             env.current[var] = previous_value
+          elsif i == 0 and equality_check? condition
+            # For conditions like a == b,
+            # set a to b inside the true branch
+            var = condition.target
+            previous_value = env.current[var]
+            env.current[var] = condition.first_arg
+            exp[branch_index] = process_if_branch branch
+            env.current[var] = previous_value
           elsif i == 1 and hash_or_array_include_all_literals? condition and early_return? branch
             var = condition.first_arg
             env.current[var] = safe_literal(var.line)
@@ -931,6 +942,11 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     end
   end
 
+  def equality_check? exp
+    call? exp and
+      exp.method == :==
+  end
+
   def simple_when? exp
     node_type? exp[1], :array and
       not node_type? exp[1][1], :splat, :array and

data/lib/brakeman/processors/gem_processor.rb

@@ -6,6 +6,7 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
   def initialize *args
     super
     @gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
+    @ruby_version = /^\s+ruby (\d\.\d.\d+)/
   end
 
   def process_gems gem_files
@@ -95,6 +96,8 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
   def set_gem_version_and_file line, file, line_num
     if line =~ @gem_name_version
       @tracker.config.add_gem $1, $2, file, line_num
+    elsif line =~ @ruby_version
+      @tracker.config.set_ruby_version $1
     end
   end
 end

data/lib/brakeman/processors/lib/rails3_route_processor.rb

@@ -78,6 +78,8 @@ class Brakeman::Rails3RoutesProcessor < Brakeman::BasicProcessor
 
   #TODO: Need test for this
   def process_root exp
+    return exp unless hash? exp.first_arg
+
     if value = hash_access(exp.first_arg, :to)
       if string? value
         add_route_from_string value

data/lib/brakeman/scanner.rb

@@ -137,7 +137,9 @@ class Brakeman::Scanner
     end
 
     if @app_tree.exists? ".ruby-version"
-      tracker.config.set_ruby_version @app_tree.file_path(".ruby-version").read
+      if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/]
+        tracker.config.set_ruby_version version
+      end
     end
 
     tracker.config.load_rails_defaults

data/lib/brakeman/tracker/config.rb

@@ -14,7 +14,7 @@ module Brakeman
       @settings = {}
       @escape_html = nil
       @erubis = nil
-      @ruby_version = ""
+      @ruby_version = nil
       @rails_version = nil
     end
 
@@ -106,6 +106,13 @@ module Brakeman
             tracker.options[:rails5] = true
             tracker.options[:rails6] = true
             Brakeman.notify "[Notice] Detected Rails 6 application"
+          elsif @rails_version.start_with? "7"
+            tracker.options[:rails3] = true
+            tracker.options[:rails4] = true
+            tracker.options[:rails5] = true
+            tracker.options[:rails6] = true
+            tracker.options[:rails7] = true
+            Brakeman.notify "[Notice] Detected Rails 7 application"
           end
         end
       end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "5.1.2"
+  Version = "5.2.2"
 end

data/lib/brakeman/warning_codes.rb

@@ -121,6 +121,10 @@ module Brakeman::WarningCodes
     :erb_template_injection => 117,
     :http_verb_confusion => 118,
     :unsafe_method_reflection => 119,
+    :eol_rails => 120,
+    :eol_ruby => 121,
+    :pending_eol_rails => 122,
+    :pending_eol_ruby => 123,
 
     :custom_check => 9090,
   }