brakeman 5.2.2 → 5.3.1

data/lib/brakeman/report/report_junit.rb

@@ -1,6 +1,6 @@
 require 'time'
-require "stringio"
-require 'rexml/document'
+require 'stringio'
+Brakeman.load_brakeman_dependency 'rexml/document'
 
 class Brakeman::Report::JUnit < Brakeman::Report::Base
   def generate_report

data/lib/brakeman/report/report_table.rb

@@ -98,7 +98,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings generic_warnings,
                     :warning,
                     'security_warnings',
-                    ["Confidence", "Class", "Method", "Warning Type", "Message"],
+                    ["Confidence", "Class", "Method", "Warning Type", "CWE ID", "Message"],
                     'Class'
   end
 
@@ -107,7 +107,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings template_warnings,
                     :template,
                     'view_warnings',
-                    ['Confidence', 'Template', 'Warning Type', 'Message'],
+                    ['Confidence', 'Template', 'Warning Type', "CWE ID", 'Message'],
                     'Template'
 
   end
@@ -117,7 +117,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings model_warnings,
                     :model,
                     'model_warnings',
-                    ['Confidence', 'Model', 'Warning Type', 'Message'],
+                    ['Confidence', 'Model', 'Warning Type', "CWE ID", 'Message'],
                     'Model'
   end
 
@@ -126,7 +126,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings controller_warnings,
                     :controller,
                     'controller_warnings',
-                    ['Confidence', 'Controller', 'Warning Type', 'Message'],
+                    ['Confidence', 'Controller', 'Warning Type', "CWE ID", 'Message'],
                     'Controller'
   end
 
@@ -134,7 +134,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings ignored_warnings,
                     :ignored,
                     'ignored_warnings',
-                    ['Confidence', 'Warning Type', 'File', 'Message'],
+                    ['Confidence', 'Warning Type', "CWE ID", 'File', 'Message'],
                     'Warning Type'
   end
 

data/lib/brakeman/report/report_text.rb

@@ -159,6 +159,8 @@ class Brakeman::Report::Text < Brakeman::Report::Base
       label('Confidence', confidence(w.confidence))
     when :category
       label('Category', w.warning_type.to_s)
+    when :cwe
+      label('CWE', w.cwe_id.join(', '))
     when :check
       label('Check', w.check_name)
     when :message

data/lib/brakeman/report/templates/controller_warnings.html.erb

@@ -5,6 +5,7 @@
       <th>Confidence</th>
       <th>Controller</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -14,6 +15,7 @@
       <td><%= warning['Confidence']%></td>
       <td><%= warning['Controller']%></td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>

data/lib/brakeman/report/templates/ignored_warnings.html.erb

@@ -6,6 +6,7 @@
         <th>Confidence</th>
         <th>File</th>
         <th>Warning Type</th>
+        <th>CWE ID</th>
         <th>Message</th>
         <th>Note</th>
       </tr>
@@ -16,6 +17,7 @@
         <td><%= warning['Confidence']%></td>
         <td><%= warning['File']%></td>
         <td><%= warning['Warning Type']%></td>
+        <td><%= warning['CWE ID']%></td>
         <td><%= warning['Message']%></td>
         <td><%= warning['Note']%></td>
       </tr>

data/lib/brakeman/report/templates/model_warnings.html.erb

@@ -5,6 +5,7 @@
       <th>Confidence</th>
       <th>Model</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -14,6 +15,7 @@
       <td><%= warning['Confidence']%></td>
       <td><%= warning['Model']%></td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>

data/lib/brakeman/report/templates/security_warnings.html.erb

@@ -6,6 +6,7 @@
       <th>Class</th>
       <th>Method</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -16,6 +17,7 @@
       <td><%= warning['Class']%></td>
       <td><%= warning['Method']%></td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>

data/lib/brakeman/report/templates/view_warnings.html.erb

@@ -5,6 +5,7 @@
       <th>Confidence</th>
       <th>Template</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -27,6 +28,7 @@
         <% end %>
       </td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "5.2.2"
+  Version = "5.3.1"
 end

data/lib/brakeman/warning.rb

@@ -5,7 +5,7 @@ require 'brakeman/messages'
 
 #The Warning class stores information about warnings
 class Brakeman::Warning
-  attr_reader :called_from, :check, :class, :confidence, :controller,
+  attr_reader :called_from, :check, :class, :confidence, :controller, :cwe_id,
     :line, :method, :model, :template, :user_input, :user_input_type,
     :warning_code, :warning_set, :warning_type
 
@@ -31,6 +31,7 @@ class Brakeman::Warning
     :class => :@class,
     :code => :@code,
     :controller => :@controller,
+    :cwe_id => :@cwe_id,
     :file => :@file,
     :gem_info => :@gem_info,
     :line => :@line,
@@ -219,6 +220,7 @@ class Brakeman::Warning
   def to_row type = :warning
     @row = { "Confidence" => TEXT_CONFIDENCE[self.confidence],
       "Warning Type" => self.warning_type.to_s,
+      "CWE ID" => self.cwe_id,
       "Message" => self.message }
 
     case type
@@ -302,7 +304,8 @@ class Brakeman::Warning
       :render_path => render_path,
       :location => self.location(false),
       :user_input => (@user_input && self.format_user_input(false)),
-      :confidence => self.confidence_name
+      :confidence => self.confidence_name,
+      :cwe_id => cwe_id
     }
   end
 

data/lib/brakeman/warning_codes.rb

@@ -125,6 +125,7 @@ module Brakeman::WarningCodes
     :eol_ruby => 121,
     :pending_eol_rails => 122,
     :pending_eol_ruby => 123,
+    :CVE_2022_32209 => 124,
 
     :custom_check => 9090,
   }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 5.2.2
+  version: 5.3.1
 platform: ruby
 authors:
 - Justin Collins
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-06 00:00:00.000000000 Z
+date: 2022-08-10 00:00:00.000000000 Z
 dependencies: []
 description: Brakeman detects security vulnerabilities in Ruby on Rails applications
   via static analysis.
@@ -275,16 +275,16 @@ files:
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib/safe_yaml/version.rb
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/run_specs_all_ruby_versions.sh
 - bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/safe_yaml.gemspec
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/History.rdoc
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/Manifest.txt
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/README.rdoc
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/composite_sexp_processor.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/pt_testcase.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/sexp.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/sexp_matcher.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/sexp_processor.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/strict_sexp.rb
-- bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib/unique.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/History.rdoc
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/Manifest.txt
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/README.rdoc
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/composite_sexp_processor.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/pt_testcase.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp_matcher.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/sexp_processor.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/strict_sexp.rb
+- bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib/unique.rb
 - bundle/ruby/2.7.0/gems/slim-4.1.0/CHANGES
 - bundle/ruby/2.7.0/gems/slim-4.1.0/Gemfile
 - bundle/ruby/2.7.0/gems/slim-4.1.0/LICENSE
@@ -387,46 +387,46 @@ files:
 - bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib/terminal-table/table_helper.rb
 - bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib/terminal-table/version.rb
 - bundle/ruby/2.7.0/gems/terminal-table-1.8.0/terminal-table.gemspec
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/COPYING
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/asciidoc.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/babel.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/bluecloth.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/builder.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/coffee.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/commonmarker.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/creole.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/csv.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/dummy.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/erb.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/erubi.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/erubis.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/etanni.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/haml.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/kramdown.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/less.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/liquid.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/livescript.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/mapping.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/markaby.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/maruku.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/nokogiri.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/pandoc.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/plain.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/prawn.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/radius.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/rdiscount.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/rdoc.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/redcarpet.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/redcloth.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/rst-pandoc.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/sass.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/sigil.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/string.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/template.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/typescript.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/wikicloth.rb
-- bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/yajl.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/COPYING
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/asciidoc.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/babel.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/bluecloth.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/builder.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/coffee.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/commonmarker.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/creole.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/csv.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/dummy.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/erb.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/erubi.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/erubis.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/etanni.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/haml.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/kramdown.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/less.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/liquid.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/livescript.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/mapping.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/markaby.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/maruku.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/nokogiri.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/pandoc.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/plain.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/prawn.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/radius.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/rdiscount.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/rdoc.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/redcarpet.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/redcloth.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/rst-pandoc.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/sass.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/sigil.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/string.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/template.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/typescript.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/wikicloth.rb
+- bundle/ruby/2.7.0/gems/tilt-2.0.11/lib/tilt/yajl.rb
 - bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/CHANGELOG.md
 - bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/MIT-LICENSE.txt
 - bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/README.md
@@ -493,6 +493,7 @@ files:
 - lib/brakeman/checks/check_reverse_tabnabbing.rb
 - lib/brakeman/checks/check_route_dos.rb
 - lib/brakeman/checks/check_safe_buffer_manipulation.rb
+- lib/brakeman/checks/check_sanitize_config_cve.rb
 - lib/brakeman/checks/check_sanitize_methods.rb
 - lib/brakeman/checks/check_secrets.rb
 - lib/brakeman/checks/check_select_tag.rb

data/bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/rst-pandoc.rb

@@ -1,18 +0,0 @@
-require 'tilt/template'
-require 'tilt/pandoc'
-
-module Tilt
-  # Pandoc reStructuredText implementation. See:
-  # http://pandoc.org/
-  # Use PandocTemplate and specify input format
-  class RstPandocTemplate < PandocTemplate
-    def tilt_to_pandoc_mapping
-      { :smartypants => :smart }
-    end
-
-    def pandoc_options
-      options.merge!(f: 'rst')
-      super
-    end
-  end
-end

data/bundle/ruby/2.7.0/gems/tilt-2.0.10/lib/tilt/sass.rb

@@ -1,52 +0,0 @@
-require 'tilt/template'
-
-module Tilt
-  # Sass template implementation. See:
-  # http://haml.hamptoncatlin.com/
-  #
-  # Sass templates do not support object scopes, locals, or yield.
-  class SassTemplate < Template
-    self.default_mime_type = 'text/css'
-
-    begin
-      require 'sassc'
-      Sass = ::SassC
-    rescue LoadError => err
-      begin
-        require 'sass'
-        Sass = ::Sass
-      rescue LoadError
-        raise err
-      end
-    end
-
-    def prepare
-      @engine = Sass::Engine.new(data, sass_options)
-    end
-
-    def evaluate(scope, locals, &block)
-      @output ||= @engine.render
-    end
-
-    def allows_script?
-      false
-    end
-
-  private
-    def sass_options
-      options.merge(:filename => eval_file, :line => line, :syntax => :sass)
-    end
-  end
-
-  # Sass's new .scss type template implementation.
-  class ScssTemplate < SassTemplate
-    self.default_mime_type = 'text/css'
-
-  private
-    def sass_options
-      options.merge(:filename => eval_file, :line => line, :syntax => :scss)
-    end
-  end
-
-end
-