brakeman 5.2.0 → 5.2.3
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGES.md +17 -0
- data/bundle/load.rb +3 -3
- data/bundle/ruby/2.7.0/gems/{parallel-1.21.0 → parallel-1.22.1}/MIT-LICENSE.txt +0 -0
- data/bundle/ruby/2.7.0/gems/{parallel-1.21.0 → parallel-1.22.1}/lib/parallel/processor_count.rb +2 -3
- data/bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel/version.rb +4 -0
- data/bundle/ruby/2.7.0/gems/{parallel-1.21.0 → parallel-1.22.1}/lib/parallel.rb +84 -4
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/History.rdoc +28 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/Manifest.txt +2 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/README.rdoc +8 -6
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/compare/normalize.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/debugging.md +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/gauntlet.md +19 -18
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/rp_extensions.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/rp_stringscanner.rb +0 -0
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby20_parser.rb +10973 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby20_parser.y +14 -27
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby21_parser.rb +10980 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby21_parser.y +14 -27
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby22_parser.rb +11123 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby22_parser.y +14 -27
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby23_parser.rb +11132 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby23_parser.y +14 -27
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby24_parser.rb +11231 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby24_parser.y +14 -27
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby25_parser.rb +11231 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby25_parser.y +14 -27
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby26_parser.rb +11253 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby26_parser.y +14 -27
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby27_parser.rb +12980 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby27_parser.y +19 -41
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby30_parser.rb +13242 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby30_parser.y +65 -90
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby31_parser.rb +13622 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1/lib/ruby3_parser.yy → ruby_parser-3.19.1/lib/ruby31_parser.y} +110 -105
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby3_parser.yy +3536 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer.rex +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer.rex.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer_strings.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_parser.rb +2 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_parser.yy +19 -41
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_parser_extras.rb +55 -2
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/tools/munge.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/tools/ripper.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/History.rdoc +6 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/Manifest.txt +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/README.rdoc +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/composite_sexp_processor.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/pt_testcase.rb +7 -3
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/sexp.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/sexp_matcher.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/sexp_processor.rb +1 -1
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/strict_sexp.rb +0 -0
- data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/unique.rb +0 -0
- data/lib/brakeman/checks/check_sql.rb +3 -2
- data/lib/brakeman/checks/check_unsafe_reflection.rb +7 -2
- data/lib/brakeman/processors/alias_processor.rb +41 -2
- data/lib/brakeman/report/ignore/interactive.rb +2 -2
- data/lib/brakeman/version.rb +1 -1
- data/lib/brakeman/warning_codes.rb +2 -0
- metadata +54 -52
- data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb +0 -4
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.rb +0 -7128
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.rb +0 -7182
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.rb +0 -7228
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.rb +0 -7237
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.rb +0 -7268
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.rb +0 -7268
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.rb +0 -7287
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.rb +0 -8517
- data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.rb +0 -8751
File without changes
|
File without changes
|
File without changes
|
data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer_strings.rb
RENAMED
File without changes
|
@@ -80,10 +80,12 @@ require "ruby25_parser"
|
|
80
80
|
require "ruby26_parser"
|
81
81
|
require "ruby27_parser"
|
82
82
|
require "ruby30_parser"
|
83
|
+
require "ruby31_parser"
|
83
84
|
|
84
85
|
class RubyParser # HACK
|
85
86
|
VERSIONS.clear # also a HACK caused by racc namespace issues
|
86
87
|
|
88
|
+
class V31 < ::Ruby31Parser; end
|
87
89
|
class V30 < ::Ruby30Parser; end
|
88
90
|
class V27 < ::Ruby27Parser; end
|
89
91
|
class V26 < ::Ruby26Parser; end
|
@@ -767,8 +767,7 @@ rule
|
|
767
767
|
|
768
768
|
cpath: tCOLON3 cname
|
769
769
|
{
|
770
|
-
|
771
|
-
result = s(:colon3, name.to_sym).line line
|
770
|
+
result = wrap :colon3, val[1]
|
772
771
|
}
|
773
772
|
| cname
|
774
773
|
{
|
@@ -793,9 +792,7 @@ rule
|
|
793
792
|
|
794
793
|
fitem: fname
|
795
794
|
{
|
796
|
-
|
797
|
-
|
798
|
-
result = s(:lit, id.to_sym).line line
|
795
|
+
result = wrap :lit, val[0]
|
799
796
|
}
|
800
797
|
| symbol
|
801
798
|
|
@@ -864,9 +861,9 @@ rule
|
|
864
861
|
}
|
865
862
|
| tCOLON3 tCONSTANT tOP_ASGN arg_rhs
|
866
863
|
{
|
867
|
-
_,
|
864
|
+
_, lhs, op, rhs = val
|
868
865
|
|
869
|
-
lhs =
|
866
|
+
lhs = wrap :colon3, lhs
|
870
867
|
result = new_const_op_asgn [lhs, op, rhs]
|
871
868
|
}
|
872
869
|
| backref tOP_ASGN arg_rhs
|
@@ -1336,9 +1333,7 @@ rule
|
|
1336
1333
|
}
|
1337
1334
|
| tCOLON3 tCONSTANT
|
1338
1335
|
{
|
1339
|
-
|
1340
|
-
|
1341
|
-
result = s(:colon3, id.to_sym).line line
|
1336
|
+
result = wrap :colon3, val[1]
|
1342
1337
|
}
|
1343
1338
|
| tLBRACK { result = lexer.lineno } aref_args tRBRACK
|
1344
1339
|
{
|
@@ -1846,8 +1841,7 @@ opt_block_args_tail: tCOMMA block_args_tail
|
|
1846
1841
|
|
1847
1842
|
bvar: tIDENTIFIER
|
1848
1843
|
{
|
1849
|
-
|
1850
|
-
result = s(:shadow, id.to_sym).line line
|
1844
|
+
result = wrap :shadow, val[0]
|
1851
1845
|
}
|
1852
1846
|
| f_bad_arg
|
1853
1847
|
|
@@ -2458,9 +2452,7 @@ opt_block_args_tail: tCOMMA block_args_tail
|
|
2458
2452
|
|
2459
2453
|
p_kw_label: tLABEL
|
2460
2454
|
{
|
2461
|
-
|
2462
|
-
|
2463
|
-
result = s(:lit, id.to_sym).line line
|
2455
|
+
result = wrap :lit, val[0]
|
2464
2456
|
}
|
2465
2457
|
|
2466
2458
|
p_kwrest: kwrest_mark tIDENTIFIER
|
@@ -2552,26 +2544,20 @@ opt_block_args_tail: tCOMMA block_args_tail
|
|
2552
2544
|
|
2553
2545
|
p_variable: tIDENTIFIER
|
2554
2546
|
{
|
2555
|
-
(id, line), = val
|
2556
|
-
|
2557
2547
|
# TODO: error_duplicate_pattern_variable(p, $1, &@1);
|
2558
2548
|
# TODO: assignable(p, $1, 0, &@$);
|
2559
|
-
result =
|
2549
|
+
result = wrap :lvar, val[0]
|
2560
2550
|
}
|
2561
2551
|
|
2562
2552
|
p_var_ref: tCARET tIDENTIFIER
|
2563
2553
|
{
|
2564
|
-
_, (id, line) = val
|
2565
|
-
|
2566
2554
|
# TODO: check id against env for lvar or dvar
|
2567
|
-
|
2568
|
-
result = s(:lvar, id.to_sym).line line
|
2555
|
+
result = wrap :lvar, val[1]
|
2569
2556
|
}
|
2570
2557
|
|
2571
2558
|
p_const: tCOLON3 cname
|
2572
2559
|
{
|
2573
|
-
|
2574
|
-
result = s(:colon3, id.to_sym).line line
|
2560
|
+
result = wrap :colon3, val[1]
|
2575
2561
|
}
|
2576
2562
|
| p_const tCOLON2 cname
|
2577
2563
|
{
|
@@ -2583,8 +2569,7 @@ opt_block_args_tail: tCOMMA block_args_tail
|
|
2583
2569
|
| tCONSTANT
|
2584
2570
|
{
|
2585
2571
|
# TODO $$ = gettable(p, $1, &@$);
|
2586
|
-
|
2587
|
-
result = s(:const, id.to_sym).line line
|
2572
|
+
result = wrap :const, val[0]
|
2588
2573
|
}
|
2589
2574
|
######################################################################
|
2590
2575
|
#endif
|
@@ -2871,18 +2856,15 @@ regexp_contents: none
|
|
2871
2856
|
|
2872
2857
|
string_dvar: tGVAR
|
2873
2858
|
{
|
2874
|
-
|
2875
|
-
result = s(:gvar, id.to_sym).line line
|
2859
|
+
result = wrap :gvar, val[0]
|
2876
2860
|
}
|
2877
2861
|
| tIVAR
|
2878
2862
|
{
|
2879
|
-
|
2880
|
-
result = s(:ivar, id.to_sym).line line
|
2863
|
+
result = wrap :ivar, val[0]
|
2881
2864
|
}
|
2882
2865
|
| tCVAR
|
2883
2866
|
{
|
2884
|
-
|
2885
|
-
result = s(:cvar, id.to_sym).line line
|
2867
|
+
result = wrap :cvar, val[0]
|
2886
2868
|
}
|
2887
2869
|
| backref
|
2888
2870
|
|
@@ -2891,17 +2873,13 @@ regexp_contents: none
|
|
2891
2873
|
|
2892
2874
|
ssym: tSYMBEG sym
|
2893
2875
|
{
|
2894
|
-
_, (id, line) = val
|
2895
|
-
|
2896
2876
|
lexer.lex_state = EXPR_END
|
2897
|
-
result =
|
2877
|
+
result = wrap :lit, val[1]
|
2898
2878
|
}
|
2899
2879
|
| tSYMBOL
|
2900
2880
|
{
|
2901
|
-
(id, line), = val
|
2902
|
-
|
2903
2881
|
lexer.lex_state = EXPR_END
|
2904
|
-
result =
|
2882
|
+
result = wrap :lit, val[0]
|
2905
2883
|
}
|
2906
2884
|
|
2907
2885
|
sym: fname | tIVAR | tGVAR | tCVAR
|
@@ -3422,10 +3400,10 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
|
|
3422
3400
|
}
|
3423
3401
|
| tLABEL arg_value
|
3424
3402
|
{
|
3425
|
-
|
3403
|
+
label, arg = val
|
3426
3404
|
|
3427
|
-
lit =
|
3428
|
-
result = s(:array, lit, arg).line line
|
3405
|
+
lit = wrap :lit, label
|
3406
|
+
result = s(:array, lit, arg).line lit.line
|
3429
3407
|
}
|
3430
3408
|
#if V >= 22
|
3431
3409
|
| tSTRING_BEG string_contents tLABEL_END arg_value
|
data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_parser_extras.rb
RENAMED
@@ -30,7 +30,7 @@ class Sexp
|
|
30
30
|
end
|
31
31
|
|
32
32
|
module RubyParserStuff
|
33
|
-
VERSION = "3.
|
33
|
+
VERSION = "3.19.1"
|
34
34
|
|
35
35
|
attr_accessor :lexer, :in_def, :in_single, :file
|
36
36
|
attr_accessor :in_kwarg
|
@@ -218,11 +218,15 @@ module RubyParserStuff
|
|
218
218
|
self.args args
|
219
219
|
end
|
220
220
|
|
221
|
+
def attrset_id? id
|
222
|
+
id =~ /^\[\]=$|^\w+=$/
|
223
|
+
end
|
224
|
+
|
221
225
|
def endless_method_name defn_or_defs
|
222
226
|
name = defn_or_defs[1]
|
223
227
|
name = defn_or_defs[2] unless Symbol === name
|
224
228
|
|
225
|
-
if
|
229
|
+
if attrset_id? name then
|
226
230
|
yyerror "setter method cannot be defined in an endless method definition"
|
227
231
|
end
|
228
232
|
|
@@ -978,6 +982,49 @@ module RubyParserStuff
|
|
978
982
|
[result, in_def]
|
979
983
|
end
|
980
984
|
|
985
|
+
def new_endless_defn val
|
986
|
+
(name, line, in_def), args, _, body, _, resbody = val
|
987
|
+
|
988
|
+
result =
|
989
|
+
if resbody then
|
990
|
+
s(:defn, name, args,
|
991
|
+
new_rescue(body,
|
992
|
+
new_resbody(s(:array).line(line),
|
993
|
+
resbody))).line line
|
994
|
+
else
|
995
|
+
s(:defn, name, args, body).line line
|
996
|
+
end
|
997
|
+
|
998
|
+
local_pop in_def
|
999
|
+
endless_method_name result
|
1000
|
+
|
1001
|
+
result.comments = self.comments.pop
|
1002
|
+
|
1003
|
+
result
|
1004
|
+
end
|
1005
|
+
|
1006
|
+
def new_endless_defs val
|
1007
|
+
(recv, (name, line, in_def)), args, _, body, _, resbody = val
|
1008
|
+
|
1009
|
+
result =
|
1010
|
+
if resbody then
|
1011
|
+
s(:defs, recv, name, args,
|
1012
|
+
new_rescue(body,
|
1013
|
+
new_resbody(s(:array).line(line),
|
1014
|
+
resbody))).line line
|
1015
|
+
else
|
1016
|
+
s(:defs, recv, name, args, body).line(line)
|
1017
|
+
end
|
1018
|
+
|
1019
|
+
self.in_single -= 1
|
1020
|
+
local_pop in_def
|
1021
|
+
endless_method_name result
|
1022
|
+
|
1023
|
+
result.comments = self.comments.pop
|
1024
|
+
|
1025
|
+
result
|
1026
|
+
end
|
1027
|
+
|
981
1028
|
def new_defs val
|
982
1029
|
_, recv, (name, line), in_def, args, body, _ = val
|
983
1030
|
|
@@ -1613,6 +1660,12 @@ module RubyParserStuff
|
|
1613
1660
|
|
1614
1661
|
alias remove_whitespace_width whitespace_width
|
1615
1662
|
|
1663
|
+
def wrap type, node
|
1664
|
+
value, line = node
|
1665
|
+
value = value.to_sym if value.respond_to? :to_sym
|
1666
|
+
s(type, value).line line
|
1667
|
+
end
|
1668
|
+
|
1616
1669
|
class Keyword
|
1617
1670
|
include RubyLexer::State::Values
|
1618
1671
|
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
File without changes
|
data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/pt_testcase.rb
RENAMED
@@ -34,6 +34,12 @@ class Examples
|
|
34
34
|
end
|
35
35
|
|
36
36
|
class ParseTreeTestCase < Minitest::Test
|
37
|
+
all_versions = %w[18 19 20 21 22 23 24 25 26 27 30 31]
|
38
|
+
most_versions = all_versions.drop(1)
|
39
|
+
|
40
|
+
TEST_SUFFIX = "_#{most_versions.join "_"}"
|
41
|
+
VER_RE = /(#{Regexp.union(*all_versions)})/
|
42
|
+
|
37
43
|
attr_accessor :processor # to be defined by subclass
|
38
44
|
|
39
45
|
def setup
|
@@ -77,7 +83,7 @@ class ParseTreeTestCase < Minitest::Test
|
|
77
83
|
end
|
78
84
|
|
79
85
|
def self.add_19tests name, hash
|
80
|
-
add_tests "#{name}
|
86
|
+
add_tests "#{name}_#{TEST_SUFFIX}", hash # HACK?
|
81
87
|
end
|
82
88
|
|
83
89
|
def self.add_19edgecases ruby, sexp, cases
|
@@ -102,8 +108,6 @@ class ParseTreeTestCase < Minitest::Test
|
|
102
108
|
testcases[verbose][klass] = testcases[nonverbose][klass]
|
103
109
|
end
|
104
110
|
|
105
|
-
VER_RE = "(1[89]|2[01234567]|3[0])"
|
106
|
-
|
107
111
|
def self.generate_test klass, node, data, input_name, output_name
|
108
112
|
klass.send :define_method, "test_#{node}" do
|
109
113
|
flunk "Processor is nil" if processor.nil?
|
File without changes
|
data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/sexp_matcher.rb
RENAMED
File without changes
|
data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/strict_sexp.rb
RENAMED
File without changes
|
File without changes
|
@@ -405,7 +405,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
|
|
405
405
|
nil
|
406
406
|
end
|
407
407
|
|
408
|
-
TO_STRING_METHODS = [:chomp, :
|
408
|
+
TO_STRING_METHODS = [:chomp, :chop, :lstrip, :rstrip, :scrub, :squish, :strip,
|
409
|
+
:strip_heredoc, :to_s, :tr]
|
409
410
|
|
410
411
|
#Returns value if interpolated value is not something safe
|
411
412
|
def unsafe_string_interp? exp
|
@@ -744,6 +745,6 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
|
|
744
745
|
date_target? exp.target
|
745
746
|
else
|
746
747
|
false
|
747
|
-
end
|
748
|
+
end
|
748
749
|
end
|
749
750
|
end
|
@@ -20,7 +20,7 @@ class Brakeman::CheckUnsafeReflection < Brakeman::BaseCheck
|
|
20
20
|
def check_unsafe_reflection result
|
21
21
|
return unless original? result
|
22
22
|
|
23
|
-
call = result[:call]
|
23
|
+
call = result[:call]
|
24
24
|
method = call.method
|
25
25
|
|
26
26
|
case method
|
@@ -37,7 +37,12 @@ class Brakeman::CheckUnsafeReflection < Brakeman::BaseCheck
|
|
37
37
|
end
|
38
38
|
|
39
39
|
if confidence
|
40
|
-
|
40
|
+
case method
|
41
|
+
when :constantize, :safe_constantize
|
42
|
+
message = msg("Unsafe reflection method ", msg_code(method), " called on ", msg_input(input))
|
43
|
+
else
|
44
|
+
message = msg("Unsafe reflection method ", msg_code(method), " called with ", msg_input(input))
|
45
|
+
end
|
41
46
|
|
42
47
|
warn :result => result,
|
43
48
|
:warning_type => "Remote Code Execution",
|
@@ -404,7 +404,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
|
|
404
404
|
end
|
405
405
|
|
406
406
|
def join_item item, join_value
|
407
|
-
if item.is_a?
|
407
|
+
if item.nil? || item.is_a?(String)
|
408
408
|
"#{item}#{join_value}"
|
409
409
|
elsif string? item or symbol? item or number? item
|
410
410
|
s(:str, "#{item.value}#{join_value}").line(item.line)
|
@@ -703,7 +703,30 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
|
|
703
703
|
end
|
704
704
|
end
|
705
705
|
|
706
|
-
|
706
|
+
# Return early unless there might be short-hand syntax,
|
707
|
+
# since handling it is kind of expensive.
|
708
|
+
return exp unless exp.any? { |e| e.nil? }
|
709
|
+
|
710
|
+
# Need to handle short-hand hash syntax
|
711
|
+
new_hash = [:hash]
|
712
|
+
hash_iterate(exp) do |key, value|
|
713
|
+
# e.g. { a: }
|
714
|
+
if value.nil? and symbol? key
|
715
|
+
# Only handling local variables for now, not calls
|
716
|
+
lvar = s(:lvar, key.value)
|
717
|
+
if var_value = env[lvar]
|
718
|
+
new_hash << key << var_value.deep_clone(key.line || 0)
|
719
|
+
else
|
720
|
+
# If the value is unknown, assume it was a call
|
721
|
+
# and set the value to a call
|
722
|
+
new_hash.concat << key << s(:call, nil, key.value).line(key.line || 0)
|
723
|
+
end
|
724
|
+
else
|
725
|
+
new_hash.concat << key << value
|
726
|
+
end
|
727
|
+
end
|
728
|
+
|
729
|
+
Sexp.from_array(new_hash).line(exp.line || 0)
|
707
730
|
end
|
708
731
|
|
709
732
|
#Merge values into hash when processing
|
@@ -864,6 +887,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
|
|
864
887
|
elsif false? condition
|
865
888
|
no_branch = true
|
866
889
|
exps = [nil, exp.else_clause]
|
890
|
+
elsif equality_check? condition and condition.target == condition.first_arg
|
891
|
+
no_branch = true
|
892
|
+
exps = [exp.then_clause, nil]
|
867
893
|
else
|
868
894
|
no_branch = false
|
869
895
|
exps = [exp.then_clause, exp.else_clause]
|
@@ -897,6 +923,14 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
|
|
897
923
|
env.current[var] = safe_literal(var.line)
|
898
924
|
exp[branch_index] = process_if_branch branch
|
899
925
|
env.current[var] = previous_value
|
926
|
+
elsif i == 0 and equality_check? condition
|
927
|
+
# For conditions like a == b,
|
928
|
+
# set a to b inside the true branch
|
929
|
+
var = condition.target
|
930
|
+
previous_value = env.current[var]
|
931
|
+
env.current[var] = condition.first_arg
|
932
|
+
exp[branch_index] = process_if_branch branch
|
933
|
+
env.current[var] = previous_value
|
900
934
|
elsif i == 1 and hash_or_array_include_all_literals? condition and early_return? branch
|
901
935
|
var = condition.first_arg
|
902
936
|
env.current[var] = safe_literal(var.line)
|
@@ -931,6 +965,11 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
|
|
931
965
|
end
|
932
966
|
end
|
933
967
|
|
968
|
+
def equality_check? exp
|
969
|
+
call? exp and
|
970
|
+
exp.method == :==
|
971
|
+
end
|
972
|
+
|
934
973
|
def simple_when? exp
|
935
974
|
node_type? exp[1], :array and
|
936
975
|
not node_type? exp[1][1], :splat, :array and
|
data/lib/brakeman/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: brakeman
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 5.2.
|
4
|
+
version: 5.2.3
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Justin Collins
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2022-05-01 00:00:00.000000000 Z
|
12
12
|
dependencies: []
|
13
13
|
description: Brakeman detects security vulnerabilities in Ruby on Rails applications
|
14
14
|
via static analysis.
|
@@ -132,10 +132,10 @@ files:
|
|
132
132
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/terminal/unix_stty.rb
|
133
133
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/version.rb
|
134
134
|
- bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/wrapper.rb
|
135
|
-
- bundle/ruby/2.7.0/gems/parallel-1.
|
136
|
-
- bundle/ruby/2.7.0/gems/parallel-1.
|
137
|
-
- bundle/ruby/2.7.0/gems/parallel-1.
|
138
|
-
- bundle/ruby/2.7.0/gems/parallel-1.
|
135
|
+
- bundle/ruby/2.7.0/gems/parallel-1.22.1/MIT-LICENSE.txt
|
136
|
+
- bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel.rb
|
137
|
+
- bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel/processor_count.rb
|
138
|
+
- bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel/version.rb
|
139
139
|
- bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt
|
140
140
|
- bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md
|
141
141
|
- bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md
|
@@ -193,42 +193,44 @@ files:
|
|
193
193
|
- bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/Manifest.txt
|
194
194
|
- bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/README.rdoc
|
195
195
|
- bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib/ruby2ruby.rb
|
196
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
197
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
198
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
199
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
200
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
201
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
202
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
203
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
204
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
205
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
206
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
207
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
208
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
209
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
210
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
211
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
212
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
213
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
214
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
215
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
216
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
217
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
218
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
219
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
220
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
221
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
222
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
223
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
224
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
225
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
226
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
227
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
228
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
229
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
230
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
231
|
-
- bundle/ruby/2.7.0/gems/ruby_parser-3.
|
196
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/History.rdoc
|
197
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/Manifest.txt
|
198
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/README.rdoc
|
199
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/compare/normalize.rb
|
200
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/debugging.md
|
201
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/gauntlet.md
|
202
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/rp_extensions.rb
|
203
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/rp_stringscanner.rb
|
204
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby20_parser.rb
|
205
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby20_parser.y
|
206
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby21_parser.rb
|
207
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby21_parser.y
|
208
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby22_parser.rb
|
209
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby22_parser.y
|
210
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby23_parser.rb
|
211
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby23_parser.y
|
212
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby24_parser.rb
|
213
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby24_parser.y
|
214
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby25_parser.rb
|
215
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby25_parser.y
|
216
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby26_parser.rb
|
217
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby26_parser.y
|
218
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby27_parser.rb
|
219
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby27_parser.y
|
220
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby30_parser.rb
|
221
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby30_parser.y
|
222
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby31_parser.rb
|
223
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby31_parser.y
|
224
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby3_parser.yy
|
225
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer.rb
|
226
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer.rex
|
227
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer.rex.rb
|
228
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer_strings.rb
|
229
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_parser.rb
|
230
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_parser.yy
|
231
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_parser_extras.rb
|
232
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/tools/munge.rb
|
233
|
+
- bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/tools/ripper.rb
|
232
234
|
- bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/History.rdoc
|
233
235
|
- bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/Manifest.txt
|
234
236
|
- bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/README.rdoc
|
@@ -273,16 +275,16 @@ files:
|
|
273
275
|
- bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib/safe_yaml/version.rb
|
274
276
|
- bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/run_specs_all_ruby_versions.sh
|
275
277
|
- bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/safe_yaml.gemspec
|
276
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
277
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
278
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
279
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
280
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
281
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
282
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
283
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
284
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
285
|
-
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.
|
278
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/History.rdoc
|
279
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/Manifest.txt
|
280
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/README.rdoc
|
281
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/composite_sexp_processor.rb
|
282
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/pt_testcase.rb
|
283
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp.rb
|
284
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp_matcher.rb
|
285
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp_processor.rb
|
286
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/strict_sexp.rb
|
287
|
+
- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/unique.rb
|
286
288
|
- bundle/ruby/2.7.0/gems/slim-4.1.0/CHANGES
|
287
289
|
- bundle/ruby/2.7.0/gems/slim-4.1.0/Gemfile
|
288
290
|
- bundle/ruby/2.7.0/gems/slim-4.1.0/LICENSE
|