brakeman 5.2.2 → 7.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7673373d923b1d6b2e4c2158a94681d01de5e5c8eb29561795c9fbe8bd879f6b
-  data.tar.gz: 44e5c623eb5fd6fe62ec7d0956a32cee82082a2c5983012ff7c172b10c6dc79a
+  metadata.gz: 388dbae9faa71cc1f26c5e63f748019d7b1570f24a9faa83ce90deabb2298675
+  data.tar.gz: b210a9e0c13a75ccce1c7897f39906331cfeda3ad46e14c682e299d0e35ac2bf
 SHA512:
-  metadata.gz: 2e3132eaffeb28f50ab40afda87c7a1f2b209044c71614bd6d68f55632479a148e08ac4dc995f370b75de352c896711ed09698056fa763b3449d2776e2ba2fb3
-  data.tar.gz: 31e069689731927b3f096fd39cb0f1f4bf9c7269e7af4487eed12b34e3a7711de77b353423975b3625f5883c4a3b4c5f9785ddf44ca4d4367007b9d44ee51205
+  metadata.gz: 4f9f5579aa7005921ca0da113900acd19a2506cdd5e774fb91bb5f89ab7f4bc51d666b246460ef51c68e0e0810e686453e492fc37dd4b0fceedb5eb3ba845327
+  data.tar.gz: 4d31c48d9cfd10a80ea070297baf4bfc37d4b807931e54d7fa80769d7bd8ce263a211bd27d1d2c35d492efaadad4aeec5a7bc8f17f2c34589e9699450075bd53

data/CHANGES.md

@@ -1,3 +1,156 @@
+# 7.1.1 - 2025-11-03
+
+* Fix false positive when calling `with_content` on ViewComponents (Peer Allan)
+* Word wrap text output in pager
+* Consider Tempfile.create.path as safe input (Ali Ismayilov)
+* Exclude directories before searching for files
+* Check each side of `or` SQL arguments
+* Ignore attribute builder in Haml 6
+* Add `FilePath#to_path` for Ruby 3.5 compatibility (S-H-GAMELINKS)
+* Fix SQL injection check for calculate method (Rohan Sharma)
+* Fix missing `td` in HTML report (John Hawthorn)
+* Check for unsafe SQL when two arguments are passed to AR methods (Patrick Brinich-Langlois)
+
+# 7.1.0 - 2025-07-18
+
+* Add EOL dates for Rails 8.0 and Ruby 3.4
+* Support render model shortcut
+* Use lazy file lists for AppTree
+* Add Haml 6.x support
+* Improve ignored warnings layout in HTML report (Sebastien Savater)
+* Update JUnit report for CircleCI (Philippe Bernery)
+* Only load escape functionality from cgi library (Earlopain)
+* Add `--ensure-no-obsolete-ignore-entries` option (viralpraxis)
+
+# 7.0.2 - 2025-04-04
+
+* Fix error with empty `BUNDLE_GEMFILE` env variable
+
+# 7.0.1 - 2025-04-03
+
+* Avoid warning on evaluation of plain strings
+* Enable use of custom/alternative Gemfiles
+* Fix error on directory with `rb` extension (viralpraxis)
+* Support `terminal-table` 4.0 (Chedli Bourguiba)
+* Better support Prism 1.4.0
+* Only output timing for each file when using `--debug`
+
+# 7.0.0 - 2024-12-30
+
+* Always warn about deserializing from Marshal
+* Output `originalBaseUriIds` for SARIF format report
+* Default to using Prism parser if available (disable with `--no-prism`)
+* Update `terminal-table` version to use latest
+* Update `eval` check to be a little noisier
+* Fix array/hash unknown index handling
+* Disable following symbolic links by default, re-enable with --follow-symlinks
+* Add step (and timing) for finding files
+* Add CSV library as explicit dependency for Ruby 3.4 support
+* Major changes to how rescanning works
+* Raise minimum Ruby version to 3.1
+* Fix hardcoded globally excluded paths
+* Remove updated entry in Brakeman ignore files (Toby Hsieh)
+* Fix recursion when handling multiple assignment expressions
+
+# 6.2.2 - 2024-10-15
+
+* Ignore more native gems when building gem
+* Revamp command injection in `pipeline*` calls
+* New end-of-support dates for Rails
+
+# 6.2.1 - 2024-08-22
+
+Just a packaging fix for brakeman.gem
+
+# 6.2.0 - 2024-08-22
+
+* Add `--show-ignored` option (Gabriel Zayas)
+* Add optional support for Prism parser
+* Warn about unscoped finds with `find_by!`
+* Treat `::X` and `X` the same, for now (Jill Klang)
+* Fix compatibility with default frozen string literals (Jean Boussier)
+* Remediation advice for command injection (Nicholas Barone)
+* Fix Ruby warnings in test suite (Jean Boussier)
+* Support YAML aliases in secret configs (Chedli Bourguiba)
+* Add initial Rails 8 support (Ron Shinall)
+* Handle mass assignment with splats
+* Add support for symbolic links (Lu Zhu)
+
+# 6.1.2 - 2024-02-01
+
+* Update Highline to 3.0
+* Add EOL date for Ruby 3.3.0
+* Avoid copying Sexps that are too large
+* Avoid detecting `ViewComponentContrib::Base` as dynamic render paths (vividmuimui)
+* Remove deprecated use of `Kernel#open("|...")`
+* Remove `safe_yaml` gem dependency
+* Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)
+
+# 6.1.1 - 2023-12-24
+
+* Handle racc as a default gem in Ruby 3.3.0
+
+# 6.1.0 - 2023-12-04
+
+* Add `--timing` to add timing duration for scan steps
+* Fix keyword splats in filter arguments
+* Add check for unfiltered search with Ransack
+* Fix class method lookup in parent classes
+* Handle `class << self`
+* Add `PG::Connection.escape_string` as a SQL sanitization method (Joévin Soulenq)
+
+# 6.0.1 - 2023-07-20
+
+* Accept strings for `load_defaults` version
+
+# 6.0.0 - 2023-05-24
+
+* Add obsolete fingerprints to comparison report
+* Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
+* Scan directories that include the word `public`
+* Raise minimum Ruby version to 3.0
+* Drop support for Ruby 1.8/1.9 syntax
+* Fix end-of-life dates for Ruby
+* Fix false positive with `content_tag` in newer Rails
+
+# 5.4.1 - 2023-02-21
+
+* Fix file/line location for EOL software warnings
+* Revise checking for request.env to only consider request headers
+* Add `redirect_back` and `redirect_back_or_to` to open redirect check
+* Support Rails 7 redirect options
+* Add Rails 6.1 and 7.0 default configuration values
+* Prevent redirects using `url_from` being marked as unsafe (Lachlan Sylvester)
+* Warn about unscoped find for `find_by(id: ...)`
+* Support `presence`, `presence_in` and `in?`
+* Fix issue with `if` expressions in `when` clauses
+
+# 5.4.0 - 2022-11-17
+
+* Use relative paths for CodeClimate report format (Mike Poage)
+* Add check for weak RSA key sizes and padding modes
+* Handle multiple values and splats in case/when
+* Ignore more model methods in redirects
+* Add check for absolute paths issue with Pathname
+* Fix `load_rails_defaults` overwriting settings in the Rails application (James Gregory-Monk)
+
+# 5.3.1 - 2022-08-09
+
+* Fix version range for CVE-2022-32209
+
+# 5.3.0 - 2022-08-09
+
+* Include explicit engine or lib paths in vendor/ (Joe Rafaniello)
+* Load rexml as a Brakeman dependency
+* Fix "full call" information propagating unnecessarily
+* Add check for CVE-2022-32209
+* Add CWE information to warnings (Stephen Aghaulor)
+
+# 5.2.3 - 2022-05-01
+
+* Fix error with hash shorthand syntax
+* Match order of interactive options with help message (Rory O'Kane)
+
 # 5.2.2 - 2022-04-06
 
 * Update `ruby_parser` for Ruby 3.1 support (Merek Skubela)

data/README.md

@@ -1,8 +1,7 @@
 [![Brakeman Logo](http://brakemanscanner.org/images/logo_medium.png)](http://brakemanscanner.org/)
 
 [![Build Status](https://circleci.com/gh/presidentbeef/brakeman.svg?style=svg)](https://circleci.com/gh/presidentbeef/brakeman)
-[![Test Coverage](https://api.codeclimate.com/v1/badges/1b08a5c74695cb0d11ec/test_coverage)](https://codeclimate.com/github/presidentbeef/brakeman/test_coverage)
-[![Gitter](https://badges.gitter.im/presidentbeef/brakeman.svg)](https://gitter.im/presidentbeef/brakeman)
+[![Code Coverage](https://qlty.sh/gh/presidentbeef/projects/brakeman/coverage.svg)](https://qlty.sh/gh/presidentbeef/projects/brakeman)
 
 # Brakeman
 
@@ -18,7 +17,7 @@ Using Bundler:
 
 ```ruby
 group :development do
-  gem 'brakeman'
+  gem 'brakeman', require: false
 end
 ```
 
@@ -64,9 +63,9 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 # Compatibility
 
-Brakeman should work with any version of Rails from 2.3.x to 6.x.
+Brakeman should work with any version of Rails from 2.3.x to 8.x.
 
-Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.4.0 to run.
+Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.
 
 # Basic Options
 
@@ -133,6 +132,10 @@ To create and manage this file, use:
 
     brakeman -I
 
+If you want to temporarily see the warnings you ignored without affecting the exit code, use:
+
+    brakeman --show-ignored
+
 # Warning information
 
 See [warning\_types](docs/warning_types) for more information on the warnings reported by this tool.
@@ -182,7 +185,7 @@ There is a [plugin available](http://brakemanscanner.org/docs/jenkins/) for Jenk
 
 For even more continuous testing, try the [Guard plugin](https://github.com/guard/guard-brakeman).
 
-There are a couple [Github Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
+There are a couple [GitHub Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
 
 # Building
 

data/bundle/load.rb

@@ -1,16 +1,17 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/temple-0.8.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/sexp_processor-4.16.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/tilt-2.0.10/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/slim-4.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/highline-2.0.3/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/haml-5.2.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/parallel-1.22.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/csv-3.3.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/haml-6.4.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/highline-3.1.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/parallel-1.27.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/reline-0.6.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/rexml-3.4.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby2ruby-2.5.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-3.20.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/sexp_processor-4.17.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/slim-5.2.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/temple-0.10.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/terminal-table-4.0.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/tilt-2.6.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-display_width-3.2.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-emoji-4.1.0/lib"

data/bundle/ruby/3.1.0/gems/csv-3.3.5/LICENSE.txt

@@ -0,0 +1,33 @@
+Copyright (C) 2005-2016 James Edward Gray II. All rights reserved.
+Copyright (C) 2007-2017 Yukihiro Matsumoto. All rights reserved.
+Copyright (C) 2017 SHIBATA Hiroshi. All rights reserved.
+Copyright (C) 2017 Olivier Lacan. All rights reserved.
+Copyright (C) 2017 Espartaco Palma. All rights reserved.
+Copyright (C) 2017 Marcus Stollsteimer. All rights reserved.
+Copyright (C) 2017 pavel. All rights reserved.
+Copyright (C) 2017-2018 Steven Daniels. All rights reserved.
+Copyright (C) 2018 Tomohiro Ogoke. All rights reserved.
+Copyright (C) 2018 Kouhei Sutou. All rights reserved.
+Copyright (C) 2018 Mitsutaka Mimura. All rights reserved.
+Copyright (C) 2018 Vladislav. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.