brakeman 5.2.0 → 5.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6cb338d80c6615c14b65edf49dd428ad57bb033e71366a2f1cc599253d28fb11
-  data.tar.gz: f310c08560f4e5dd9d55983ba41e8ad64ac5cce07a805415ddd51658069c8fb9
+  metadata.gz: 88049c2c49d114a2921ded02a16ae8be8cb9717976aa026d14a8386046668702
+  data.tar.gz: 2d3bbf4de0df432415432657e0ff658eddd7edb860a29def3d1ae707e968b143
 SHA512:
-  metadata.gz: d79a9b1253b5bce89082ea81ed8ece812299c7df06a68248cb2e03866e32a57d685615e0b9f5f5ed36250f70d1f64705eced85dab9c4497dd529aa6416055755
-  data.tar.gz: 89279ff60b5a728a10017c905cbc43da143eb78064d4531b913bcb545d566ffdcfad6744e718eb1ac082cec4333ea7a0b2bdf29c39b77cae236fabf9cdeb8cca
+  metadata.gz: 3910fabad6692126c5080485901629763cebd2355107fe821c2077af74fe2e1566cf936e7135e5d2c301bf43b8f95f6534c06cabfa56638a839e86a1202fbd40
+  data.tar.gz: d012ad0ee09eb897912350f399d0ff12589a2bf46f63a7dc9459f88dfa39c3aee9da6dd751c4636cd6e0b050781e0bef5e7471587da7a3446f66a196e81549c6

data/CHANGES.md

@@ -1,3 +1,53 @@
+# 5.4.1 - 2023-02-21
+
+* Fix file/line location for EOL software warnings
+* Revise checking for request.env to only consider request headers
+* Add `redirect_back` and `redirect_back_or_to` to open redirect check
+* Support Rails 7 redirect options
+* Add Rails 6.1 and 7.0 default configuration values
+* Prevent redirects using `url_from` being marked as unsafe (Lachlan Sylvester)
+* Warn about unscoped find for `find_by(id: ...)`
+* Support `presence`, `presence_in` and `in?`
+* Fix issue with `if` expressions in `when` clauses
+
+# 5.4.0 - 2022-11-17
+
+* Use relative paths for CodeClimate report format (Mike Poage)
+* Add check for weak RSA key sizes and padding modes
+* Handle multiple values and splats in case/when
+* Ignore more model methods in redirects
+* Add check for absolute paths issue with Pathname
+* Fix `load_rails_defaults` overwriting settings in the Rails application (James Gregory-Monk)
+
+# 5.3.1 - 2022-08-09
+
+* Fix version range for CVE-2022-32209
+
+# 5.3.0 - 2022-08-09
+
+* Include explicit engine or lib paths in vendor/ (Joe Rafaniello)
+* Load rexml as a Brakeman dependency
+* Fix "full call" information propagating unnecessarily
+* Add check for CVE-2022-32209
+* Add CWE information to warnings (Stephen Aghaulor)
+
+# 5.2.3 - 2022-05-01
+
+* Fix error with hash shorthand syntax
+* Match order of interactive options with help message (Rory O'Kane)
+
+# 5.2.2 - 2022-04-06
+
+* Update `ruby_parser` for Ruby 3.1 support (Merek Skubela)
+* Handle `nil` when joining values (Dan Buettner)
+* Update message for unsafe reflection (Pedro Baracho)
+* Add additional String methods for SQL injection check
+* Respect equality in `if` conditions
+
+# 5.2.1 - 2022-01-30
+
+* Add warning codes for EOL software warnings
+
 # 5.2.0 - 2021-12-15
 
 * Initial Rails 7 support

data/README.md

@@ -64,9 +64,9 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 # Compatibility
 
-Brakeman should work with any version of Rails from 2.3.x to 6.x.
+Brakeman should work with any version of Rails from 2.3.x to 7.x.
 
-Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.4.0 to run.
+Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.5.0 to run.
 
 # Basic Options
 

data/bundle/load.rb

@@ -1,16 +1,16 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-3.18.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/temple-0.8.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/tilt-2.0.10/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/slim-4.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/highline-2.0.3/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/haml-5.2.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/parallel-1.21.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/haml-5.2.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/highline-2.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/parallel-1.22.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/rexml-3.2.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby2ruby-2.4.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-3.19.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-legacy-1.0.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/sexp_processor-4.16.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/slim-4.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/temple-0.8.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/terminal-table-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/tilt-2.0.11/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-display_width-1.8.0/lib"

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/Changelog.md

@@ -2,6 +2,12 @@
 
 Below is a complete listing of changes for each revision of HighLine.
 
+### 2.1.0 / 2022-12-31
+* PR #255 - Change minimum Ruby version requirement to 2.3 (@abinoam)
+* PR #254 - Improve Github Actions file (@abinoam)
+* PR #253, PR #251 - Setup GitHub Actions and remove Travis (@petergoldstein, rev by @AlexWayfer)
+* PR #250 - Fix file permissions (@bdunne)
+
 ### 2.0.3 / 2019-10-11
 * PR #245 - Suppress `Psych.safe_load` arg warn (@koic)
 

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/Gemfile

@@ -7,16 +7,13 @@ git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 # Specify your gem's dependencies in tgem.gemspec
 gemspec
 
-platform :ruby do
-  # Running only on MRI
-  gem "simplecov", group: :test
-end
+gem "simplecov", group: :test, require: false
 
 group :code_quality do
   gem "flog", require: false
   gem "pronto", require: false, platform: :ruby
   gem "pronto-flay", require: false, platform: :ruby
-  gem "pronto-poper", require: false, platform: :ruby
+  # gem "pronto-poper", require: false, platform: :ruby
   gem "pronto-reek", require: false, platform: :ruby
   gem "pronto-rubocop", require: false, platform: :ruby
 end

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/README.md

@@ -1,8 +1,7 @@
 HighLine
 ========
 
-[![Build Status](https://travis-ci.org/JEG2/highline.svg?branch=master)](https://travis-ci.org/JEG2/highline)
-[![Build status](https://ci.appveyor.com/api/projects/status/4p05fijpah77d28x/branch/master?svg=true)](https://ci.appveyor.com/project/JEG2/highline/branch/master)
+[![Tests](https://github.com/JEG2/highline/actions/workflows/ci.yml/badge.svg)](https://github.com/JEG2/highline/actions/workflows/ci.yml)
 [![Gem Version](https://badge.fury.io/rb/highline.svg)](https://badge.fury.io/rb/highline)
 [![Code Climate](https://codeclimate.com/github/JEG2/highline/badges/gpa.svg)](https://codeclimate.com/github/JEG2/highline)
 [![Test Coverage](https://codeclimate.com/github/JEG2/highline/badges/coverage.svg)](https://codeclimate.com/github/JEG2/highline/coverage)

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/highline.gemspec

@@ -27,7 +27,7 @@ DESCRIPTION
 
   spec.extra_rdoc_files = %w[README.md TODO Changelog.md LICENSE]
 
-  spec.required_ruby_version = ">= 1.9.3"
+  spec.required_ruby_version = ">= 2.3"
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/lib/highline/version.rb

@@ -2,5 +2,5 @@
 
 class HighLine
   # The version of the installed library.
-  VERSION = "2.0.3".freeze
+  VERSION = "2.1.0".freeze
 end

data/bundle/ruby/{2.7.0/gems/parallel-1.21.0 → 3.1.0/gems/parallel-1.22.1}/lib/parallel/processor_count.rb

@@ -1,11 +1,10 @@
 # frozen_string_literal: true
-require 'etc'
-
 module Parallel
   # TODO: inline this method into parallel.rb and kill physical_processor_count in next major release
   module ProcessorCount
     # Number of processors seen by the OS, used for process scheduling
     def processor_count
+      require 'etc'
       @processor_count ||= Integer(ENV['PARALLEL_PROCESSOR_COUNT'] || Etc.nprocessors)
     end
 
@@ -19,7 +18,7 @@ module Parallel
           when /linux/
             cores = {} # unique physical ID / core ID combinations
             phy = 0
-            IO.read("/proc/cpuinfo").scan(/^physical id.*|^core id.*/) do |ln|
+            File.read("/proc/cpuinfo").scan(/^physical id.*|^core id.*/) do |ln|
               if ln.start_with?("physical")
                 phy = ln[/\d+/]
               elsif ln.start_with?("core")

data/bundle/ruby/3.1.0/gems/parallel-1.22.1/lib/parallel/version.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+module Parallel
+  VERSION = Version = '1.22.1' # rubocop:disable Naming/ConstantName
+end

data/bundle/ruby/{2.7.0/gems/parallel-1.21.0 → 3.1.0/gems/parallel-1.22.1}/lib/parallel.rb

@@ -264,6 +264,9 @@ module Parallel
       elsif options[:in_threads]
         method = :in_threads
         size = options[method]
+      elsif options[:in_ractors]
+        method = :in_ractors
+        size = options[method]
       else
         method = :in_processes
         if Process.respond_to?(:fork)
@@ -285,6 +288,8 @@ module Parallel
           work_direct(job_factory, options, &block)
         elsif method == :in_threads
           work_in_threads(job_factory, options.merge(count: size), &block)
+        elsif method == :in_ractors
+          work_in_ractors(job_factory, options.merge(count: size), &block)
         else
           work_in_processes(job_factory, options.merge(count: size), &block)
         end
@@ -382,6 +387,72 @@ module Parallel
       exception || results
     end
 
+    def work_in_ractors(job_factory, options)
+      exception = nil
+      results = []
+      results_mutex = Mutex.new # arrays are not thread-safe on jRuby
+
+      callback = options[:ractor]
+      if block_given? || !callback
+        raise ArgumentError, "pass the code you want to execute as `ractor: [ClassName, :method_name]`"
+      end
+
+      # build
+      ractors = Array.new(options.fetch(:count)) do
+        Ractor.new do
+          loop do
+            got = receive
+            (klass, method_name), item, index = got
+            break if index == :break
+            begin
+              Ractor.yield [nil, klass.send(method_name, item), item, index]
+            rescue StandardError => e
+              Ractor.yield [e, nil, item, index]
+            end
+          end
+        end
+      end
+
+      # start
+      ractors.dup.each do |ractor|
+        if set = job_factory.next
+          item, index = set
+          instrument_start item, index, options
+          ractor.send [callback, item, index]
+        else
+          ractor.send([[nil, nil], nil, :break]) # stop the ractor
+          ractors.delete ractor
+        end
+      end
+
+      # replace with new items
+      while set = job_factory.next
+        item_next, index_next = set
+        done, (exception, result, item, index) = Ractor.select(*ractors)
+        if exception
+          ractors.delete done
+          break
+        end
+        instrument_finish item, index, result, options
+        results_mutex.synchronize { results[index] = (options[:preserve_results] == false ? nil : result) }
+
+        instrument_start item_next, index_next, options
+        done.send([callback, item_next, index_next])
+      end
+
+      # finish
+      ractors.each do |ractor|
+        (new_exception, result, item, index) = ractor.take
+        exception ||= new_exception
+        next if new_exception
+        instrument_finish item, index, result, options
+        results_mutex.synchronize { results[index] = (options[:preserve_results] == false ? nil : result) }
+        ractor.send([[nil, nil], nil, :break]) # stop the ractor
+      end
+
+      exception || results
+    end
+
     def work_in_processes(job_factory, options, &blk)
       workers = create_workers(job_factory, options, &blk)
       results = []
@@ -426,6 +497,7 @@ module Parallel
           end
         end
       end
+
       exception || results
     end
 
@@ -521,12 +593,20 @@ module Parallel
     end
 
     def with_instrumentation(item, index, options)
-      on_start = options[:start]
-      on_finish = options[:finish]
-      options[:mutex].synchronize { on_start.call(item, index) } if on_start
+      instrument_start(item, index, options)
       result = yield
-      options[:mutex].synchronize { on_finish.call(item, index, result) } if on_finish
+      instrument_finish(item, index, result, options)
       result unless options[:preserve_results] == false
     end
+
+    def instrument_finish(item, index, result, options)
+      return unless on_finish = options[:finish]
+      options[:mutex].synchronize { on_finish.call(item, index, result) }
+    end
+
+    def instrument_start(item, index, options)
+      return unless on_start = options[:start]
+      options[:mutex].synchronize { on_start.call(item, index) }
+    end
   end
 end

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.18.1 → 3.1.0/gems/ruby_parser-3.19.2}/History.rdoc

@@ -1,3 +1,41 @@
+=== 3.19.2 / 2022-12-03
+
+* 5 bug fixes:
+
+  * Fixed bug parsing array patterns using %w, %i, etc.
+  * Fixed dedenting when heredoc has only empty line and interpolation. (mvz)
+  * Fixed dsym unescaping. (mvz)
+  * Fixed vars in pattern matching that should be lasgn, not lvar.
+  * find_pat mid-patterns are now splatted inline, not wrapped in an array_pat.
+
+=== 3.19.1 / 2022-04-05
+
+* 2 bug fixes:
+
+  * Added comments to endless defn and defs. (mvz)
+  * Fixed endless method bug handling attrset names.
+
+=== 3.19.0 / 2022-03-29
+
+* 1 major enhancement:
+
+  * Added tentative 3.1 support.
+
+* 7 minor enhancements:
+
+  * 3.1: bare RHS assoc: { y: } => s(:hash, s(:lit, :y), nil)
+  * 3.1: calls w/ unnamed block args (bare &)
+  * 3.1: endless defn/defs w/ paren-less calls (aka commands)
+  * 3.1: pattern capture to nonlocal vars, eg: ^@a, ^$b, ^@@c
+  * 3.1: pattern: ^(expr) => expr
+  * Improved steps for adding new versions.
+  * Improved steps for running gauntlets.
+
+* 2 bug fixes:
+
+  * Bumped 2.6+ cached versions for rake compare.
+  * Skip test_regexp_esc_C_slash on ruby 3.1.0 because of MRI bug.
+
 === 3.18.1 / 2021-11-10
 
 * 1 minor enhancement:

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.18.1 → 3.1.0/gems/ruby_parser-3.19.2}/Manifest.txt

@@ -29,6 +29,8 @@ lib/ruby27_parser.rb
 lib/ruby27_parser.y
 lib/ruby30_parser.rb
 lib/ruby30_parser.y
+lib/ruby31_parser.rb
+lib/ruby31_parser.y
 lib/ruby3_parser.yy
 lib/ruby_lexer.rb
 lib/ruby_lexer.rex

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.18.1 → 3.1.0/gems/ruby_parser-3.19.2}/README.rdoc

@@ -33,6 +33,9 @@ Tested against 801,039 files from the latest of all rubygems (as of 2013-05):
 * 1.9 parser is at 99.9940% accuracy, 4.013 sigma
 * 2.0 parser is at 99.9939% accuracy, 4.008 sigma
 * 2.6 parser is at 99.9972% accuracy, 4.191 sigma
+* 3.0 parser has a 100% parse rate.
+  * Tested against 2,672,412 unique ruby files across 167k gems.
+  * As do all the others now, basically.
 
 == FEATURES/PROBLEMS:
 
@@ -62,15 +65,14 @@ You can also use Ruby19Parser, Ruby18Parser, or RubyParser.for_current_ruby:
 
 To add a new version:
 
-* New parser should be generated from lib/ruby_parser.yy.
-* Extend lib/ruby_parser.yy with new class name.
-* Add new version number to V2 in Rakefile for rule creation.
+* New parser should be generated from lib/ruby[3]_parser.yy.
+* Extend lib/ruby[3]_parser.yy with new class name.
+* Add new version number to V2/V3 in Rakefile for rule creation.
+* Add new (full) version to `ruby_parse` section of Rakefile for rake compare
 * Require generated parser in lib/ruby_parser.rb.
 * Add empty TestRubyParserShared##Plus module and TestRubyParserV## to test/test_ruby_parser.rb.
 * Extend Manifest.txt with generated file names.
-* Extend sexp_processor's pt_testcase.rb to match version
-  * add_19tests needs to have the version added
-  * VER_RE needs to have the regexp expanded
+* Add new version number to sexp_processor's pt_testcase.rb in all_versions
 
 Until all of these are done, you won't have a clean test run.
 

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.18.1 → 3.1.0/gems/ruby_parser-3.19.2}/gauntlet.md

@@ -19,10 +19,10 @@ an external disk. Here is the config:
 And I update using rake:
 
 ```
-% cd ~/Work/git/rubygems/rubygems-mirror
+% cd GIT/rubygems/rubygems-mirror
 % git down
 % rake mirror:latest
-% /Volumes/StuffA/gauntlet/bin/cleanup.rb
+% /Volumes/StuffA/gauntlet/bin/cleanup.rb -y -v
 ```
 
 This rather quickly updates my mirror to the latest versions of
@@ -34,22 +34,23 @@ bit, but it is pretty minimal (currently ~20 bad gems).
 ## Curating an Archive of Ruby Files
 
 Next, I process the gem mirror into a much more digestable structure
-using `hash.rb` (TODO: needs a better name):
+using `unpack_gems.rb`.
 
 ```
-% cd RP
-% /Volumes/StuffA/gauntlet/bin/unpack_gems.rb
+% cd RP/gauntlet
+% time caffeinate /Volumes/StuffA/gauntlet/bin/unpack_gems.rb -v [-a] ; say done
 ... waaaait ...
-% mv hashed.noindex gauntlet.$(today).noindex
-% lrztar gauntlet.$(today).noindex
-% mv gauntlet.$(today).noindex.lrz /Volumes/StuffA/gauntlet/
+% DIR=gauntlet.$(today).(all|new).noindex
+% mv hashed.noindex $DIR
+% tar vc -T <(fd -tf . $DIR | sort) | zstd -5 -T0 --long > archives/$DIR.tar.zst ; say done
+% ./bin/sync.sh
 ```
 
-This script filters all the newer gems (TODO: WHY?), unpacks them,
-finds all the files that look like they're valid ruby, ensures they're
-valid ruby (using the current version of ruby to compile them), and
-then moves them into a SHA dir structure that looks something like
-this:
+This script filters all the newer (< 1 year old) gems (unless `-a` is
+used), unpacks them, finds all the files that look like they're valid
+ruby, ensures they're valid ruby (using the current version of ruby to
+compile them), and then moves them into a SHA dir structure that looks
+something like this:
 
 ```
 hashed.noindex/a/b/c/<full_file_sha>.rb
@@ -64,8 +65,8 @@ Unpacking, validating, SHA'ing everything is disk and CPU intensive.
 The `.noindex` extension stops spotlight from indexing the continous
 churn of files being unpacked and moved and saves time.
 
-Finally, I rename and archive it all up (currently using lrztar, but
-I'm not in love with it).
+Finally, I rename and archive it all up (currently using zstd to
+compress).
 
 ### Stats
 
@@ -73,7 +74,7 @@ I'm not in love with it).
 9696 % find gauntlet.$(today).noindex -type f | lc
   561270
 3.5G gauntlet.2021-08-06.noindex
-239M gauntlet.2021-08-06.noindex.tar.lrz
+239M gauntlet.2021-08-06.noindex.tar.zst
 ```
 
 So I wind up with a little over half a million unique ruby files to
@@ -84,7 +85,7 @@ parse. It's about 3.5g but compresses very nicely down to 240m
 Assuming you're starting from scratch, unpack the archive once:
 
 ```
-% lrzuntar gauntlet.$(today).noindex.lrz
+% zstdcat gauntlet.$(today).noindex.tar.zst | tar x
 ```
 
 Then, either run a single process (easier to read):
@@ -96,7 +97,7 @@ Then, either run a single process (easier to read):
 Or max out your machine using xargs (note the `-P 16` and choose accordingly):
 
 ```
-% ls -d gauntlet/*.noindex/?/? | xargs -n 1 -P 16 ./gauntlet/bin/gauntlet.rb
+% ls -d gauntlet/*.noindex/?/? | time xargs -n 1 -P 16 ./gauntlet/bin/gauntlet.rb
 ```
 
 In another terminal I usually monitor the progress like so: