brakeman 5.2.3 → 6.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ae08a71e19d6c694a9e567fda5793a56ab174d106f44b178f7e9f69c3057814
-  data.tar.gz: fd24750e512d528b3fd9cecb344f4788a58e1aa8ffd6b28ff7c88bc7f034a3e8
+  metadata.gz: 3bfe97a2a21052a6b89113eba0488d389790be712085e953b0661bfdad31f5ea
+  data.tar.gz: 9155ab4eb06b34c7e8294a63bc1878f4e754087f4c7eebc10ff0232f9b62ad14
 SHA512:
-  metadata.gz: e0e2d7fde5907d8158b21803876b0dd77e659ce8cae42c25e23021b46bd2c9d8c5d0dd13edff64f7fd721a8d1bca92af4a9fbbf2505e47c791557a3316c0f3d2
-  data.tar.gz: 38f894b42f893a6ce45db047f2d21c1529b63de0dd19e00a69475a72cbb4c2d9738f0f25edc60460d61607182d5a5c01ccbb77a6ae6eeae69ec4e88f9345a2e1
+  metadata.gz: 67f98784f2eff71cde186b940d6c7bae38495529d1f3882eee6f92103b9c44fb06caa62dd5e6ed2cfaab82b01e7a1c41b951b2529fd4b04e54e6c2ca89a65a91
+  data.tar.gz: a35a4a539a877bdf2eb2150ef4556d31f995be90ce23a2b2d9697ffae41bb2ec2d7fefbfcb853c10897849f554d87b6c03e9a24265fd965158815df8f445a79b

data/CHANGES.md

@@ -1,3 +1,50 @@
+# 6.0.1 - 2023-07-20
+
+* Accept strings for `load_defaults` version
+
+# 6.0.0 - 2023-05-24
+
+* Add obsolete fingerprints to comparison report
+* Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
+* Scan directories that include the word `public`
+* Raise minimum Ruby version to 3.0
+* Drop support for Ruby 1.8/1.9 syntax
+* Fix end-of-life dates for Ruby
+* Fix false positive with `content_tag` in newer Rails
+
+# 5.4.1 - 2023-02-21
+
+* Fix file/line location for EOL software warnings
+* Revise checking for request.env to only consider request headers
+* Add `redirect_back` and `redirect_back_or_to` to open redirect check
+* Support Rails 7 redirect options
+* Add Rails 6.1 and 7.0 default configuration values
+* Prevent redirects using `url_from` being marked as unsafe (Lachlan Sylvester)
+* Warn about unscoped find for `find_by(id: ...)`
+* Support `presence`, `presence_in` and `in?`
+* Fix issue with `if` expressions in `when` clauses
+
+# 5.4.0 - 2022-11-17
+
+* Use relative paths for CodeClimate report format (Mike Poage)
+* Add check for weak RSA key sizes and padding modes
+* Handle multiple values and splats in case/when
+* Ignore more model methods in redirects
+* Add check for absolute paths issue with Pathname
+* Fix `load_rails_defaults` overwriting settings in the Rails application (James Gregory-Monk)
+
+# 5.3.1 - 2022-08-09
+
+* Fix version range for CVE-2022-32209
+
+# 5.3.0 - 2022-08-09
+
+* Include explicit engine or lib paths in vendor/ (Joe Rafaniello)
+* Load rexml as a Brakeman dependency
+* Fix "full call" information propagating unnecessarily
+* Add check for CVE-2022-32209
+* Add CWE information to warnings (Stephen Aghaulor)
+
 # 5.2.3 - 2022-05-01
 
 * Fix error with hash shorthand syntax

data/README.md

@@ -64,9 +64,9 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 # Compatibility
 
-Brakeman should work with any version of Rails from 2.3.x to 6.x.
+Brakeman should work with any version of Rails from 2.3.x to 7.x.
 
-Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.4.0 to run.
+Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.
 
 # Basic Options
 
@@ -182,7 +182,7 @@ There is a [plugin available](http://brakemanscanner.org/docs/jenkins/) for Jenk
 
 For even more continuous testing, try the [Guard plugin](https://github.com/guard/guard-brakeman).
 
-There are a couple [Github Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
+There are a couple [GitHub Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
 
 # Building
 

data/bundle/load.rb

@@ -1,16 +1,15 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/temple-0.8.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/tilt-2.0.10/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/slim-4.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/highline-2.0.3/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/haml-5.2.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/parallel-1.22.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/haml-5.2.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/highline-2.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/parallel-1.23.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/rexml-3.2.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby2ruby-2.4.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-3.20.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/sexp_processor-4.17.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/slim-4.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/temple-0.8.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/terminal-table-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/tilt-2.0.11/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-display_width-1.8.0/lib"

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/Changelog.md

@@ -2,6 +2,12 @@
 
 Below is a complete listing of changes for each revision of HighLine.
 
+### 2.1.0 / 2022-12-31
+* PR #255 - Change minimum Ruby version requirement to 2.3 (@abinoam)
+* PR #254 - Improve Github Actions file (@abinoam)
+* PR #253, PR #251 - Setup GitHub Actions and remove Travis (@petergoldstein, rev by @AlexWayfer)
+* PR #250 - Fix file permissions (@bdunne)
+
 ### 2.0.3 / 2019-10-11
 * PR #245 - Suppress `Psych.safe_load` arg warn (@koic)
 

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/Gemfile

@@ -7,16 +7,13 @@ git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
 # Specify your gem's dependencies in tgem.gemspec
 gemspec
 
-platform :ruby do
-  # Running only on MRI
-  gem "simplecov", group: :test
-end
+gem "simplecov", group: :test, require: false
 
 group :code_quality do
   gem "flog", require: false
   gem "pronto", require: false, platform: :ruby
   gem "pronto-flay", require: false, platform: :ruby
-  gem "pronto-poper", require: false, platform: :ruby
+  # gem "pronto-poper", require: false, platform: :ruby
   gem "pronto-reek", require: false, platform: :ruby
   gem "pronto-rubocop", require: false, platform: :ruby
 end

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/README.md

@@ -1,8 +1,7 @@
 HighLine
 ========
 
-[![Build Status](https://travis-ci.org/JEG2/highline.svg?branch=master)](https://travis-ci.org/JEG2/highline)
-[![Build status](https://ci.appveyor.com/api/projects/status/4p05fijpah77d28x/branch/master?svg=true)](https://ci.appveyor.com/project/JEG2/highline/branch/master)
+[![Tests](https://github.com/JEG2/highline/actions/workflows/ci.yml/badge.svg)](https://github.com/JEG2/highline/actions/workflows/ci.yml)
 [![Gem Version](https://badge.fury.io/rb/highline.svg)](https://badge.fury.io/rb/highline)
 [![Code Climate](https://codeclimate.com/github/JEG2/highline/badges/gpa.svg)](https://codeclimate.com/github/JEG2/highline)
 [![Test Coverage](https://codeclimate.com/github/JEG2/highline/badges/coverage.svg)](https://codeclimate.com/github/JEG2/highline/coverage)

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/highline.gemspec

@@ -27,7 +27,7 @@ DESCRIPTION
 
   spec.extra_rdoc_files = %w[README.md TODO Changelog.md LICENSE]
 
-  spec.required_ruby_version = ">= 1.9.3"
+  spec.required_ruby_version = ">= 2.3"
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"

data/bundle/ruby/{2.7.0/gems/highline-2.0.3 → 3.1.0/gems/highline-2.1.0}/lib/highline/version.rb

@@ -2,5 +2,5 @@
 
 class HighLine
   # The version of the installed library.
-  VERSION = "2.0.3".freeze
+  VERSION = "2.1.0".freeze
 end

data/bundle/ruby/3.1.0/gems/parallel-1.23.0/lib/parallel/version.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+module Parallel
+  VERSION = Version = '1.23.0' # rubocop:disable Naming/ConstantName
+end

data/bundle/ruby/{2.7.0/gems/parallel-1.22.1 → 3.1.0/gems/parallel-1.23.0}/lib/parallel.rb

@@ -1,11 +1,8 @@
 # frozen_string_literal: true
 require 'rbconfig'
 require 'parallel/version'
-require 'parallel/processor_count'
 
 module Parallel
-  extend ProcessorCount
-
   Stop = Object.new.freeze
 
   class DeadWorker < StandardError
@@ -307,6 +304,49 @@ module Parallel
       map(*args, &block).flatten(1)
     end
 
+    def filter_map(*args, &block)
+      map(*args, &block).compact
+    end
+
+    # Number of physical processor cores on the current system.
+    def physical_processor_count
+      @physical_processor_count ||= begin
+        ppc =
+          case RbConfig::CONFIG["target_os"]
+          when /darwin[12]/
+            IO.popen("/usr/sbin/sysctl -n hw.physicalcpu").read.to_i
+          when /linux/
+            cores = {} # unique physical ID / core ID combinations
+            phy = 0
+            File.read("/proc/cpuinfo").scan(/^physical id.*|^core id.*/) do |ln|
+              if ln.start_with?("physical")
+                phy = ln[/\d+/]
+              elsif ln.start_with?("core")
+                cid = "#{phy}:#{ln[/\d+/]}"
+                cores[cid] = true unless cores[cid]
+              end
+            end
+            cores.count
+          when /mswin|mingw/
+            require 'win32ole'
+            result_set = WIN32OLE.connect("winmgmts://").ExecQuery(
+              "select NumberOfCores from Win32_Processor"
+            )
+            result_set.to_enum.collect(&:NumberOfCores).reduce(:+)
+          else
+            processor_count
+          end
+        # fall back to logical count if physical info is invalid
+        ppc > 0 ? ppc : processor_count
+      end
+    end
+
+    # Number of processors seen by the OS, used for process scheduling
+    def processor_count
+      require 'etc'
+      @processor_count ||= Integer(ENV['PARALLEL_PROCESSOR_COUNT'] || Etc.nprocessors)
+    end
+
     def worker_number
       Thread.current[:parallel_worker_number]
     end

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.19.1 → 3.1.0/gems/ruby_parser-3.20.3}/History.rdoc

@@ -1,3 +1,51 @@
+=== 3.20.3 / 2023-07-11
+
+* 2 minor enhancements:
+
+  * Added Parser#in_argdef and integrated into 3.x parsers.
+  * Improved tools/munge.rb to handler MRI 3.2 output
+
+* 2 bug fixes:
+
+  * Fixed process_dots to properly deal with paren-less forward_args. (eric1234)
+  * Fixed tools/ripper.rb to properly print ripper sexp at the end
+
+=== 3.20.2 / 2023-06-06
+
+* 1 bug fix:
+
+  * 3.2: fixed parsing of f(*) and f(**). (agrobbin)
+
+=== 3.20.1 / 2023-05-16
+
+* 1 minor enhancement:
+
+  * Fixes Sexp#line_max in parser for many constructs: paren_args, arrays of various sorts, calls, classes, modules, etc.
+
+=== 3.20.0 / 2023-03-04
+
+* 1 major enhancement:
+
+  * Added tentative 3.2 support.
+
+* 1 minor enhancement:
+
+  * Change minimum ruby version to 2.6. (want higher)
+
+* 1 bug fix:
+
+  * Fix up compare tasks for ruby 3.2 differences.
+
+=== 3.19.2 / 2022-12-03
+
+* 5 bug fixes:
+
+  * Fixed bug parsing array patterns using %w, %i, etc.
+  * Fixed dedenting when heredoc has only empty line and interpolation. (mvz)
+  * Fixed dsym unescaping. (mvz)
+  * Fixed vars in pattern matching that should be lasgn, not lvar.
+  * find_pat mid-patterns are now splatted inline, not wrapped in an array_pat.
+
 === 3.19.1 / 2022-04-05
 
 * 2 bug fixes:

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.19.1 → 3.1.0/gems/ruby_parser-3.20.3}/Manifest.txt

@@ -31,6 +31,8 @@ lib/ruby30_parser.rb
 lib/ruby30_parser.y
 lib/ruby31_parser.rb
 lib/ruby31_parser.y
+lib/ruby32_parser.rb
+lib/ruby32_parser.y
 lib/ruby3_parser.yy
 lib/ruby_lexer.rb
 lib/ruby_lexer.rex

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.19.1 → 3.1.0/gems/ruby_parser-3.20.3}/README.rdoc

@@ -68,8 +68,9 @@ To add a new version:
 * New parser should be generated from lib/ruby[3]_parser.yy.
 * Extend lib/ruby[3]_parser.yy with new class name.
 * Add new version number to V2/V3 in Rakefile for rule creation.
-* Add new (full) version to `ruby_parse` section of Rakefile for rake compare
+* Add new `ruby_parse "x.y.z"` line to Rakefile for rake compare (line ~300).
 * Require generated parser in lib/ruby_parser.rb.
+* Add new V## = ::Ruby##Parser; end to ruby_parser.rb (bottom of file).
 * Add empty TestRubyParserShared##Plus module and TestRubyParserV## to test/test_ruby_parser.rb.
 * Extend Manifest.txt with generated file names.
 * Add new version number to sexp_processor's pt_testcase.rb in all_versions

data/bundle/ruby/{2.7.0/gems/ruby_parser-3.19.1 → 3.1.0/gems/ruby_parser-3.20.3}/compare/normalize.rb

@@ -84,6 +84,7 @@ def munge s
 
              "' '",             "tSPACE", # needs to be later to avoid bad hits
 
+             "ε",               "none", # bison 3+
              "%empty",          "none", # newer bison
              "/* empty */",     "none",
              /^\s*$/,           "none",