brakeman 5.2.0 → 5.2.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (72) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +17 -0
  3. data/bundle/load.rb +3 -3
  4. data/bundle/ruby/2.7.0/gems/{parallel-1.21.0 → parallel-1.22.1}/MIT-LICENSE.txt +0 -0
  5. data/bundle/ruby/2.7.0/gems/{parallel-1.21.0 → parallel-1.22.1}/lib/parallel/processor_count.rb +2 -3
  6. data/bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel/version.rb +4 -0
  7. data/bundle/ruby/2.7.0/gems/{parallel-1.21.0 → parallel-1.22.1}/lib/parallel.rb +84 -4
  8. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/History.rdoc +28 -0
  9. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/Manifest.txt +2 -0
  10. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/README.rdoc +8 -6
  11. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/compare/normalize.rb +0 -0
  12. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/debugging.md +0 -0
  13. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/gauntlet.md +19 -18
  14. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/rp_extensions.rb +0 -0
  15. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/rp_stringscanner.rb +0 -0
  16. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby20_parser.rb +10973 -0
  17. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby20_parser.y +14 -27
  18. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby21_parser.rb +10980 -0
  19. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby21_parser.y +14 -27
  20. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby22_parser.rb +11123 -0
  21. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby22_parser.y +14 -27
  22. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby23_parser.rb +11132 -0
  23. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby23_parser.y +14 -27
  24. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby24_parser.rb +11231 -0
  25. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby24_parser.y +14 -27
  26. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby25_parser.rb +11231 -0
  27. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby25_parser.y +14 -27
  28. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby26_parser.rb +11253 -0
  29. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby26_parser.y +14 -27
  30. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby27_parser.rb +12980 -0
  31. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby27_parser.y +19 -41
  32. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby30_parser.rb +13242 -0
  33. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby30_parser.y +65 -90
  34. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby31_parser.rb +13622 -0
  35. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1/lib/ruby3_parser.yy → ruby_parser-3.19.1/lib/ruby31_parser.y} +110 -105
  36. data/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby3_parser.yy +3536 -0
  37. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer.rb +0 -0
  38. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer.rex +0 -0
  39. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer.rex.rb +0 -0
  40. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_lexer_strings.rb +0 -0
  41. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_parser.rb +2 -0
  42. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_parser.yy +19 -41
  43. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/lib/ruby_parser_extras.rb +55 -2
  44. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/tools/munge.rb +0 -0
  45. data/bundle/ruby/2.7.0/gems/{ruby_parser-3.18.1 → ruby_parser-3.19.1}/tools/ripper.rb +0 -0
  46. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/History.rdoc +6 -0
  47. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/Manifest.txt +0 -0
  48. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/README.rdoc +0 -0
  49. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/composite_sexp_processor.rb +0 -0
  50. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/pt_testcase.rb +7 -3
  51. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/sexp.rb +0 -0
  52. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/sexp_matcher.rb +0 -0
  53. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/sexp_processor.rb +1 -1
  54. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/strict_sexp.rb +0 -0
  55. data/bundle/ruby/2.7.0/gems/{sexp_processor-4.16.0 → sexp_processor-4.16.1}/lib/unique.rb +0 -0
  56. data/lib/brakeman/checks/check_sql.rb +3 -2
  57. data/lib/brakeman/checks/check_unsafe_reflection.rb +7 -2
  58. data/lib/brakeman/processors/alias_processor.rb +41 -2
  59. data/lib/brakeman/report/ignore/interactive.rb +2 -2
  60. data/lib/brakeman/version.rb +1 -1
  61. data/lib/brakeman/warning_codes.rb +2 -0
  62. metadata +54 -52
  63. data/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb +0 -4
  64. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.rb +0 -7128
  65. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.rb +0 -7182
  66. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.rb +0 -7228
  67. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.rb +0 -7237
  68. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.rb +0 -7268
  69. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.rb +0 -7268
  70. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.rb +0 -7287
  71. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.rb +0 -8517
  72. data/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.rb +0 -8751
@@ -80,10 +80,12 @@ require "ruby25_parser"
80
80
  require "ruby26_parser"
81
81
  require "ruby27_parser"
82
82
  require "ruby30_parser"
83
+ require "ruby31_parser"
83
84
 
84
85
  class RubyParser # HACK
85
86
  VERSIONS.clear # also a HACK caused by racc namespace issues
86
87
 
88
+ class V31 < ::Ruby31Parser; end
87
89
  class V30 < ::Ruby30Parser; end
88
90
  class V27 < ::Ruby27Parser; end
89
91
  class V26 < ::Ruby26Parser; end
@@ -767,8 +767,7 @@ rule
767
767
 
768
768
  cpath: tCOLON3 cname
769
769
  {
770
- _, (name, line) = val
771
- result = s(:colon3, name.to_sym).line line
770
+ result = wrap :colon3, val[1]
772
771
  }
773
772
  | cname
774
773
  {
@@ -793,9 +792,7 @@ rule
793
792
 
794
793
  fitem: fname
795
794
  {
796
- (id, line), = val
797
-
798
- result = s(:lit, id.to_sym).line line
795
+ result = wrap :lit, val[0]
799
796
  }
800
797
  | symbol
801
798
 
@@ -864,9 +861,9 @@ rule
864
861
  }
865
862
  | tCOLON3 tCONSTANT tOP_ASGN arg_rhs
866
863
  {
867
- _, (lhs, line), op, rhs = val
864
+ _, lhs, op, rhs = val
868
865
 
869
- lhs = s(:colon3, lhs.to_sym).line line
866
+ lhs = wrap :colon3, lhs
870
867
  result = new_const_op_asgn [lhs, op, rhs]
871
868
  }
872
869
  | backref tOP_ASGN arg_rhs
@@ -1336,9 +1333,7 @@ rule
1336
1333
  }
1337
1334
  | tCOLON3 tCONSTANT
1338
1335
  {
1339
- _, (id, line) = val
1340
-
1341
- result = s(:colon3, id.to_sym).line line
1336
+ result = wrap :colon3, val[1]
1342
1337
  }
1343
1338
  | tLBRACK { result = lexer.lineno } aref_args tRBRACK
1344
1339
  {
@@ -1846,8 +1841,7 @@ opt_block_args_tail: tCOMMA block_args_tail
1846
1841
 
1847
1842
  bvar: tIDENTIFIER
1848
1843
  {
1849
- (id, line), = val
1850
- result = s(:shadow, id.to_sym).line line
1844
+ result = wrap :shadow, val[0]
1851
1845
  }
1852
1846
  | f_bad_arg
1853
1847
 
@@ -2458,9 +2452,7 @@ opt_block_args_tail: tCOMMA block_args_tail
2458
2452
 
2459
2453
  p_kw_label: tLABEL
2460
2454
  {
2461
- (id, line), = val
2462
-
2463
- result = s(:lit, id.to_sym).line line
2455
+ result = wrap :lit, val[0]
2464
2456
  }
2465
2457
 
2466
2458
  p_kwrest: kwrest_mark tIDENTIFIER
@@ -2552,26 +2544,20 @@ opt_block_args_tail: tCOMMA block_args_tail
2552
2544
 
2553
2545
  p_variable: tIDENTIFIER
2554
2546
  {
2555
- (id, line), = val
2556
-
2557
2547
  # TODO: error_duplicate_pattern_variable(p, $1, &@1);
2558
2548
  # TODO: assignable(p, $1, 0, &@$);
2559
- result = s(:lvar, id.to_sym).line line
2549
+ result = wrap :lvar, val[0]
2560
2550
  }
2561
2551
 
2562
2552
  p_var_ref: tCARET tIDENTIFIER
2563
2553
  {
2564
- _, (id, line) = val
2565
-
2566
2554
  # TODO: check id against env for lvar or dvar
2567
-
2568
- result = s(:lvar, id.to_sym).line line
2555
+ result = wrap :lvar, val[1]
2569
2556
  }
2570
2557
 
2571
2558
  p_const: tCOLON3 cname
2572
2559
  {
2573
- _, (id, line) = val
2574
- result = s(:colon3, id.to_sym).line line
2560
+ result = wrap :colon3, val[1]
2575
2561
  }
2576
2562
  | p_const tCOLON2 cname
2577
2563
  {
@@ -2583,8 +2569,7 @@ opt_block_args_tail: tCOMMA block_args_tail
2583
2569
  | tCONSTANT
2584
2570
  {
2585
2571
  # TODO $$ = gettable(p, $1, &@$);
2586
- (id, line), = val
2587
- result = s(:const, id.to_sym).line line
2572
+ result = wrap :const, val[0]
2588
2573
  }
2589
2574
  ######################################################################
2590
2575
  #endif
@@ -2871,18 +2856,15 @@ regexp_contents: none
2871
2856
 
2872
2857
  string_dvar: tGVAR
2873
2858
  {
2874
- (id, line), = val
2875
- result = s(:gvar, id.to_sym).line line
2859
+ result = wrap :gvar, val[0]
2876
2860
  }
2877
2861
  | tIVAR
2878
2862
  {
2879
- (id, line), = val
2880
- result = s(:ivar, id.to_sym).line line
2863
+ result = wrap :ivar, val[0]
2881
2864
  }
2882
2865
  | tCVAR
2883
2866
  {
2884
- (id, line), = val
2885
- result = s(:cvar, id.to_sym).line line
2867
+ result = wrap :cvar, val[0]
2886
2868
  }
2887
2869
  | backref
2888
2870
 
@@ -2891,17 +2873,13 @@ regexp_contents: none
2891
2873
 
2892
2874
  ssym: tSYMBEG sym
2893
2875
  {
2894
- _, (id, line) = val
2895
-
2896
2876
  lexer.lex_state = EXPR_END
2897
- result = s(:lit, id.to_sym).line line
2877
+ result = wrap :lit, val[1]
2898
2878
  }
2899
2879
  | tSYMBOL
2900
2880
  {
2901
- (id, line), = val
2902
-
2903
2881
  lexer.lex_state = EXPR_END
2904
- result = s(:lit, id.to_sym).line line
2882
+ result = wrap :lit, val[0]
2905
2883
  }
2906
2884
 
2907
2885
  sym: fname | tIVAR | tGVAR | tCVAR
@@ -3422,10 +3400,10 @@ keyword_variable: kNIL { result = s(:nil).line lexer.lineno }
3422
3400
  }
3423
3401
  | tLABEL arg_value
3424
3402
  {
3425
- (label, line), arg = val
3403
+ label, arg = val
3426
3404
 
3427
- lit = s(:lit, label.to_sym).line line
3428
- result = s(:array, lit, arg).line line
3405
+ lit = wrap :lit, label
3406
+ result = s(:array, lit, arg).line lit.line
3429
3407
  }
3430
3408
  #if V >= 22
3431
3409
  | tSTRING_BEG string_contents tLABEL_END arg_value
@@ -30,7 +30,7 @@ class Sexp
30
30
  end
31
31
 
32
32
  module RubyParserStuff
33
- VERSION = "3.18.1"
33
+ VERSION = "3.19.1"
34
34
 
35
35
  attr_accessor :lexer, :in_def, :in_single, :file
36
36
  attr_accessor :in_kwarg
@@ -218,11 +218,15 @@ module RubyParserStuff
218
218
  self.args args
219
219
  end
220
220
 
221
+ def attrset_id? id
222
+ id =~ /^\[\]=$|^\w+=$/
223
+ end
224
+
221
225
  def endless_method_name defn_or_defs
222
226
  name = defn_or_defs[1]
223
227
  name = defn_or_defs[2] unless Symbol === name
224
228
 
225
- if name.end_with? "=" then
229
+ if attrset_id? name then
226
230
  yyerror "setter method cannot be defined in an endless method definition"
227
231
  end
228
232
 
@@ -978,6 +982,49 @@ module RubyParserStuff
978
982
  [result, in_def]
979
983
  end
980
984
 
985
+ def new_endless_defn val
986
+ (name, line, in_def), args, _, body, _, resbody = val
987
+
988
+ result =
989
+ if resbody then
990
+ s(:defn, name, args,
991
+ new_rescue(body,
992
+ new_resbody(s(:array).line(line),
993
+ resbody))).line line
994
+ else
995
+ s(:defn, name, args, body).line line
996
+ end
997
+
998
+ local_pop in_def
999
+ endless_method_name result
1000
+
1001
+ result.comments = self.comments.pop
1002
+
1003
+ result
1004
+ end
1005
+
1006
+ def new_endless_defs val
1007
+ (recv, (name, line, in_def)), args, _, body, _, resbody = val
1008
+
1009
+ result =
1010
+ if resbody then
1011
+ s(:defs, recv, name, args,
1012
+ new_rescue(body,
1013
+ new_resbody(s(:array).line(line),
1014
+ resbody))).line line
1015
+ else
1016
+ s(:defs, recv, name, args, body).line(line)
1017
+ end
1018
+
1019
+ self.in_single -= 1
1020
+ local_pop in_def
1021
+ endless_method_name result
1022
+
1023
+ result.comments = self.comments.pop
1024
+
1025
+ result
1026
+ end
1027
+
981
1028
  def new_defs val
982
1029
  _, recv, (name, line), in_def, args, body, _ = val
983
1030
 
@@ -1613,6 +1660,12 @@ module RubyParserStuff
1613
1660
 
1614
1661
  alias remove_whitespace_width whitespace_width
1615
1662
 
1663
+ def wrap type, node
1664
+ value, line = node
1665
+ value = value.to_sym if value.respond_to? :to_sym
1666
+ s(type, value).line line
1667
+ end
1668
+
1616
1669
  class Keyword
1617
1670
  include RubyLexer::State::Values
1618
1671
 
@@ -1,3 +1,9 @@
1
+ === 4.16.1 / 2022-04-09
2
+
3
+ * 1 minor enhancement:
4
+
5
+ * Reworked ParseTreeTestCase's notion of versions to make it easier to extend.
6
+
1
7
  === 4.16.0 / 2021-10-27
2
8
 
3
9
  * 4 minor enhancements:
@@ -34,6 +34,12 @@ class Examples
34
34
  end
35
35
 
36
36
  class ParseTreeTestCase < Minitest::Test
37
+ all_versions = %w[18 19 20 21 22 23 24 25 26 27 30 31]
38
+ most_versions = all_versions.drop(1)
39
+
40
+ TEST_SUFFIX = "_#{most_versions.join "_"}"
41
+ VER_RE = /(#{Regexp.union(*all_versions)})/
42
+
37
43
  attr_accessor :processor # to be defined by subclass
38
44
 
39
45
  def setup
@@ -77,7 +83,7 @@ class ParseTreeTestCase < Minitest::Test
77
83
  end
78
84
 
79
85
  def self.add_19tests name, hash
80
- add_tests "#{name}__19_20_21_22_23_24_25_26_27_30", hash # HACK?
86
+ add_tests "#{name}_#{TEST_SUFFIX}", hash # HACK?
81
87
  end
82
88
 
83
89
  def self.add_19edgecases ruby, sexp, cases
@@ -102,8 +108,6 @@ class ParseTreeTestCase < Minitest::Test
102
108
  testcases[verbose][klass] = testcases[nonverbose][klass]
103
109
  end
104
110
 
105
- VER_RE = "(1[89]|2[01234567]|3[0])"
106
-
107
111
  def self.generate_test klass, node, data, input_name, output_name
108
112
  klass.send :define_method, "test_#{node}" do
109
113
  flunk "Processor is nil" if processor.nil?
@@ -34,7 +34,7 @@ require "sexp"
34
34
  class SexpProcessor
35
35
 
36
36
  # duh
37
- VERSION = "4.16.0"
37
+ VERSION = "4.16.1"
38
38
 
39
39
  ##
40
40
  # Automatically shifts off the Sexp type before handing the
@@ -405,7 +405,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
405
405
  nil
406
406
  end
407
407
 
408
- TO_STRING_METHODS = [:chomp, :to_s, :squish, :strip, :strip_heredoc]
408
+ TO_STRING_METHODS = [:chomp, :chop, :lstrip, :rstrip, :scrub, :squish, :strip,
409
+ :strip_heredoc, :to_s, :tr]
409
410
 
410
411
  #Returns value if interpolated value is not something safe
411
412
  def unsafe_string_interp? exp
@@ -744,6 +745,6 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
744
745
  date_target? exp.target
745
746
  else
746
747
  false
747
- end
748
+ end
748
749
  end
749
750
  end
@@ -20,7 +20,7 @@ class Brakeman::CheckUnsafeReflection < Brakeman::BaseCheck
20
20
  def check_unsafe_reflection result
21
21
  return unless original? result
22
22
 
23
- call = result[:call]
23
+ call = result[:call]
24
24
  method = call.method
25
25
 
26
26
  case method
@@ -37,7 +37,12 @@ class Brakeman::CheckUnsafeReflection < Brakeman::BaseCheck
37
37
  end
38
38
 
39
39
  if confidence
40
- message = msg("Unsafe reflection method ", msg_code(method), " called with ", msg_input(input))
40
+ case method
41
+ when :constantize, :safe_constantize
42
+ message = msg("Unsafe reflection method ", msg_code(method), " called on ", msg_input(input))
43
+ else
44
+ message = msg("Unsafe reflection method ", msg_code(method), " called with ", msg_input(input))
45
+ end
41
46
 
42
47
  warn :result => result,
43
48
  :warning_type => "Remote Code Execution",
@@ -404,7 +404,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
404
404
  end
405
405
 
406
406
  def join_item item, join_value
407
- if item.is_a? String
407
+ if item.nil? || item.is_a?(String)
408
408
  "#{item}#{join_value}"
409
409
  elsif string? item or symbol? item or number? item
410
410
  s(:str, "#{item.value}#{join_value}").line(item.line)
@@ -703,7 +703,30 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
703
703
  end
704
704
  end
705
705
 
706
- exp
706
+ # Return early unless there might be short-hand syntax,
707
+ # since handling it is kind of expensive.
708
+ return exp unless exp.any? { |e| e.nil? }
709
+
710
+ # Need to handle short-hand hash syntax
711
+ new_hash = [:hash]
712
+ hash_iterate(exp) do |key, value|
713
+ # e.g. { a: }
714
+ if value.nil? and symbol? key
715
+ # Only handling local variables for now, not calls
716
+ lvar = s(:lvar, key.value)
717
+ if var_value = env[lvar]
718
+ new_hash << key << var_value.deep_clone(key.line || 0)
719
+ else
720
+ # If the value is unknown, assume it was a call
721
+ # and set the value to a call
722
+ new_hash.concat << key << s(:call, nil, key.value).line(key.line || 0)
723
+ end
724
+ else
725
+ new_hash.concat << key << value
726
+ end
727
+ end
728
+
729
+ Sexp.from_array(new_hash).line(exp.line || 0)
707
730
  end
708
731
 
709
732
  #Merge values into hash when processing
@@ -864,6 +887,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
864
887
  elsif false? condition
865
888
  no_branch = true
866
889
  exps = [nil, exp.else_clause]
890
+ elsif equality_check? condition and condition.target == condition.first_arg
891
+ no_branch = true
892
+ exps = [exp.then_clause, nil]
867
893
  else
868
894
  no_branch = false
869
895
  exps = [exp.then_clause, exp.else_clause]
@@ -897,6 +923,14 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
897
923
  env.current[var] = safe_literal(var.line)
898
924
  exp[branch_index] = process_if_branch branch
899
925
  env.current[var] = previous_value
926
+ elsif i == 0 and equality_check? condition
927
+ # For conditions like a == b,
928
+ # set a to b inside the true branch
929
+ var = condition.target
930
+ previous_value = env.current[var]
931
+ env.current[var] = condition.first_arg
932
+ exp[branch_index] = process_if_branch branch
933
+ env.current[var] = previous_value
900
934
  elsif i == 1 and hash_or_array_include_all_literals? condition and early_return? branch
901
935
  var = condition.first_arg
902
936
  env.current[var] = safe_literal(var.line)
@@ -931,6 +965,11 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
931
965
  end
932
966
  end
933
967
 
968
+ def equality_check? exp
969
+ call? exp and
970
+ exp.method == :==
971
+ end
972
+
934
973
  def simple_when? exp
935
974
  node_type? exp[1], :array and
936
975
  not node_type? exp[1][1], :splat, :array and
@@ -88,10 +88,10 @@ module Brakeman
88
88
 
89
89
  m.choice "i"
90
90
  m.choice "n"
91
- m.choice "k"
91
+ m.choice "s"
92
92
  m.choice "u"
93
93
  m.choice "a"
94
- m.choice "s"
94
+ m.choice "k"
95
95
  m.choice "q"
96
96
  m.choice "?" do
97
97
  show_help
@@ -1,3 +1,3 @@
1
1
  module Brakeman
2
- Version = "5.2.0"
2
+ Version = "5.2.3"
3
3
  end
@@ -123,6 +123,8 @@ module Brakeman::WarningCodes
123
123
  :unsafe_method_reflection => 119,
124
124
  :eol_rails => 120,
125
125
  :eol_ruby => 121,
126
+ :pending_eol_rails => 122,
127
+ :pending_eol_ruby => 123,
126
128
 
127
129
  :custom_check => 9090,
128
130
  }
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: brakeman
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.2.0
4
+ version: 5.2.3
5
5
  platform: ruby
6
6
  authors:
7
7
  - Justin Collins
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-12-16 00:00:00.000000000 Z
11
+ date: 2022-05-01 00:00:00.000000000 Z
12
12
  dependencies: []
13
13
  description: Brakeman detects security vulnerabilities in Ruby on Rails applications
14
14
  via static analysis.
@@ -132,10 +132,10 @@ files:
132
132
  - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/terminal/unix_stty.rb
133
133
  - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/version.rb
134
134
  - bundle/ruby/2.7.0/gems/highline-2.0.3/lib/highline/wrapper.rb
135
- - bundle/ruby/2.7.0/gems/parallel-1.21.0/MIT-LICENSE.txt
136
- - bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel.rb
137
- - bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/processor_count.rb
138
- - bundle/ruby/2.7.0/gems/parallel-1.21.0/lib/parallel/version.rb
135
+ - bundle/ruby/2.7.0/gems/parallel-1.22.1/MIT-LICENSE.txt
136
+ - bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel.rb
137
+ - bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel/processor_count.rb
138
+ - bundle/ruby/2.7.0/gems/parallel-1.22.1/lib/parallel/version.rb
139
139
  - bundle/ruby/2.7.0/gems/rexml-3.2.5/LICENSE.txt
140
140
  - bundle/ruby/2.7.0/gems/rexml-3.2.5/NEWS.md
141
141
  - bundle/ruby/2.7.0/gems/rexml-3.2.5/README.md
@@ -193,42 +193,44 @@ files:
193
193
  - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/Manifest.txt
194
194
  - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/README.rdoc
195
195
  - bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib/ruby2ruby.rb
196
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/History.rdoc
197
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/Manifest.txt
198
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/README.rdoc
199
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/compare/normalize.rb
200
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/debugging.md
201
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/gauntlet.md
202
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/rp_extensions.rb
203
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/rp_stringscanner.rb
204
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.rb
205
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby20_parser.y
206
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.rb
207
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby21_parser.y
208
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.rb
209
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby22_parser.y
210
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.rb
211
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby23_parser.y
212
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.rb
213
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby24_parser.y
214
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.rb
215
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby25_parser.y
216
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.rb
217
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby26_parser.y
218
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.rb
219
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby27_parser.y
220
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.rb
221
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby30_parser.y
222
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby3_parser.yy
223
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer.rb
224
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer.rex
225
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer.rex.rb
226
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_lexer_strings.rb
227
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_parser.rb
228
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_parser.yy
229
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib/ruby_parser_extras.rb
230
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/tools/munge.rb
231
- - bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/tools/ripper.rb
196
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/History.rdoc
197
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/Manifest.txt
198
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/README.rdoc
199
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/compare/normalize.rb
200
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/debugging.md
201
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/gauntlet.md
202
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/rp_extensions.rb
203
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/rp_stringscanner.rb
204
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby20_parser.rb
205
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby20_parser.y
206
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby21_parser.rb
207
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby21_parser.y
208
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby22_parser.rb
209
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby22_parser.y
210
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby23_parser.rb
211
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby23_parser.y
212
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby24_parser.rb
213
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby24_parser.y
214
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby25_parser.rb
215
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby25_parser.y
216
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby26_parser.rb
217
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby26_parser.y
218
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby27_parser.rb
219
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby27_parser.y
220
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby30_parser.rb
221
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby30_parser.y
222
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby31_parser.rb
223
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby31_parser.y
224
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby3_parser.yy
225
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer.rb
226
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer.rex
227
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer.rex.rb
228
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_lexer_strings.rb
229
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_parser.rb
230
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_parser.yy
231
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib/ruby_parser_extras.rb
232
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/tools/munge.rb
233
+ - bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/tools/ripper.rb
232
234
  - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/History.rdoc
233
235
  - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/Manifest.txt
234
236
  - bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/README.rdoc
@@ -273,16 +275,16 @@ files:
273
275
  - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib/safe_yaml/version.rb
274
276
  - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/run_specs_all_ruby_versions.sh
275
277
  - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/safe_yaml.gemspec
276
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/History.rdoc
277
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/Manifest.txt
278
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/README.rdoc
279
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/composite_sexp_processor.rb
280
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/pt_testcase.rb
281
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/sexp.rb
282
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/sexp_matcher.rb
283
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/sexp_processor.rb
284
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/strict_sexp.rb
285
- - bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/unique.rb
278
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/History.rdoc
279
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/Manifest.txt
280
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/README.rdoc
281
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/composite_sexp_processor.rb
282
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/pt_testcase.rb
283
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp.rb
284
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp_matcher.rb
285
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp_processor.rb
286
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/strict_sexp.rb
287
+ - bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/unique.rb
286
288
  - bundle/ruby/2.7.0/gems/slim-4.1.0/CHANGES
287
289
  - bundle/ruby/2.7.0/gems/slim-4.1.0/Gemfile
288
290
  - bundle/ruby/2.7.0/gems/slim-4.1.0/LICENSE
@@ -1,4 +0,0 @@
1
- # frozen_string_literal: true
2
- module Parallel
3
- VERSION = Version = '1.21.0' # rubocop:disable Naming/ConstantName
4
- end