brakeman 5.2.3 → 7.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ae08a71e19d6c694a9e567fda5793a56ab174d106f44b178f7e9f69c3057814
-  data.tar.gz: fd24750e512d528b3fd9cecb344f4788a58e1aa8ffd6b28ff7c88bc7f034a3e8
+  metadata.gz: 0ed78bfa3355b4eb1c645ca0a97f71062335cc685a7372bd0b9d443862cfcc9a
+  data.tar.gz: d7fc4e62c433b96f78bb85cae1f1beab0fd7a9f18d6c4876bcb089bb5361eb1e
 SHA512:
-  metadata.gz: e0e2d7fde5907d8158b21803876b0dd77e659ce8cae42c25e23021b46bd2c9d8c5d0dd13edff64f7fd721a8d1bca92af4a9fbbf2505e47c791557a3316c0f3d2
-  data.tar.gz: 38f894b42f893a6ce45db047f2d21c1529b63de0dd19e00a69475a72cbb4c2d9738f0f25edc60460d61607182d5a5c01ccbb77a6ae6eeae69ec4e88f9345a2e1
+  metadata.gz: 83ef69806ae9b921367cf2cd94b91ea361049ad08daed08c99e44debd6e331c2084fe51bd75573074e5677ce7227b0e59a5cb750d0692358df584be12a9ab3d8
+  data.tar.gz: d57d3ade3e1f10fb0a1a0cc23fb2ed68001cbd0e05d3e5035b3ef854d63825ecae66d030201600abfc02ecfe5051859374720a67949e642ba97c127880d8f93b

data/CHANGES.md

@@ -1,3 +1,114 @@
+# 7.0.0 - 2024-12-30
+
+* Always warn about deserializing from Marshal
+* Output `originalBaseUriIds` for SARIF format report
+* Default to using Prism parser if available (disable with `--no-prism`)
+* Update `terminal-table` version to use latest
+* Update `eval` check to be a little noisier
+* Fix array/hash unknown index handling
+* Disable following symbolic links by default, re-enable with --follow-symlinks
+* Add step (and timing) for finding files
+* Add CSV library as explicit dependency for Ruby 3.4 support
+* Major changes to how rescanning works
+* Raise minimum Ruby version to 3.1
+* Fix hardcoded globally excluded paths
+* Remove updated entry in Brakeman ignore files (Toby Hsieh)
+* Fix recursion when handling multiple assignment expressions
+
+# 6.2.2 - 2024-10-15
+
+* Ignore more native gems when building gem
+* Revamp command injection in `pipeline*` calls
+* New end-of-support dates for Rails
+
+# 6.2.1 - 2024-08-22
+
+Just a packaging fix for brakeman.gem
+
+# 6.2.0 - 2024-08-22
+
+* Add `--show-ignored` option (Gabriel Zayas)
+* Add optional support for Prism parser
+* Warn about unscoped finds with `find_by!`
+* Treat `::X` and `X` the same, for now (Jill Klang)
+* Fix compatibility with default frozen string literals (Jean Boussier)
+* Remediation advice for command injection (Nicholas Barone)
+* Fix Ruby warnings in test suite (Jean Boussier)
+* Support YAML aliases in secret configs (Chedli Bourguiba)
+* Add initial Rails 8 support (Ron Shinall)
+* Handle mass assignment with splats
+* Add support for symbolic links (Lu Zhu)
+
+# 6.1.2 - 2024-02-01
+
+* Update Highline to 3.0
+* Add EOL date for Ruby 3.3.0
+* Avoid copying Sexps that are too large
+* Avoid detecting `ViewComponentContrib::Base` as dynamic render paths (vividmuimui)
+* Remove deprecated use of `Kernel#open("|...")`
+* Remove `safe_yaml` gem dependency
+* Avoid detecting Phlex components as dynamic render paths (Máximo Mussini)
+
+# 6.1.1 - 2023-12-24
+
+* Handle racc as a default gem in Ruby 3.3.0
+
+# 6.1.0 - 2023-12-04
+
+* Add `--timing` to add timing duration for scan steps
+* Fix keyword splats in filter arguments
+* Add check for unfiltered search with Ransack
+* Fix class method lookup in parent classes
+* Handle `class << self`
+* Add `PG::Connection.escape_string` as a SQL sanitization method (Joévin Soulenq)
+
+# 6.0.1 - 2023-07-20
+
+* Accept strings for `load_defaults` version
+
+# 6.0.0 - 2023-05-24
+
+* Add obsolete fingerprints to comparison report
+* Warn about missing CSRF protection when defaults are not loaded (Chris Kruger)
+* Scan directories that include the word `public`
+* Raise minimum Ruby version to 3.0
+* Drop support for Ruby 1.8/1.9 syntax
+* Fix end-of-life dates for Ruby
+* Fix false positive with `content_tag` in newer Rails
+
+# 5.4.1 - 2023-02-21
+
+* Fix file/line location for EOL software warnings
+* Revise checking for request.env to only consider request headers
+* Add `redirect_back` and `redirect_back_or_to` to open redirect check
+* Support Rails 7 redirect options
+* Add Rails 6.1 and 7.0 default configuration values
+* Prevent redirects using `url_from` being marked as unsafe (Lachlan Sylvester)
+* Warn about unscoped find for `find_by(id: ...)`
+* Support `presence`, `presence_in` and `in?`
+* Fix issue with `if` expressions in `when` clauses
+
+# 5.4.0 - 2022-11-17
+
+* Use relative paths for CodeClimate report format (Mike Poage)
+* Add check for weak RSA key sizes and padding modes
+* Handle multiple values and splats in case/when
+* Ignore more model methods in redirects
+* Add check for absolute paths issue with Pathname
+* Fix `load_rails_defaults` overwriting settings in the Rails application (James Gregory-Monk)
+
+# 5.3.1 - 2022-08-09
+
+* Fix version range for CVE-2022-32209
+
+# 5.3.0 - 2022-08-09
+
+* Include explicit engine or lib paths in vendor/ (Joe Rafaniello)
+* Load rexml as a Brakeman dependency
+* Fix "full call" information propagating unnecessarily
+* Add check for CVE-2022-32209
+* Add CWE information to warnings (Stephen Aghaulor)
+
 # 5.2.3 - 2022-05-01
 
 * Fix error with hash shorthand syntax

data/README.md

@@ -2,7 +2,6 @@
 
 [![Build Status](https://circleci.com/gh/presidentbeef/brakeman.svg?style=svg)](https://circleci.com/gh/presidentbeef/brakeman)
 [![Test Coverage](https://api.codeclimate.com/v1/badges/1b08a5c74695cb0d11ec/test_coverage)](https://codeclimate.com/github/presidentbeef/brakeman/test_coverage)
-[![Gitter](https://badges.gitter.im/presidentbeef/brakeman.svg)](https://gitter.im/presidentbeef/brakeman)
 
 # Brakeman
 
@@ -18,7 +17,7 @@ Using Bundler:
 
 ```ruby
 group :development do
-  gem 'brakeman'
+  gem 'brakeman', require: false
 end
 ```
 
@@ -64,9 +63,9 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 # Compatibility
 
-Brakeman should work with any version of Rails from 2.3.x to 6.x.
+Brakeman should work with any version of Rails from 2.3.x to 7.x.
 
-Brakeman can analyze code written with Ruby 1.8 syntax and newer, but requires at least Ruby 2.4.0 to run.
+Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.
 
 # Basic Options
 
@@ -133,6 +132,10 @@ To create and manage this file, use:
 
     brakeman -I
 
+If you want to temporarily see the warnings you ignored without affecting the exit code, use:
+
+    brakeman --show-ignored
+
 # Warning information
 
 See [warning\_types](docs/warning_types) for more information on the warnings reported by this tool.
@@ -182,7 +185,7 @@ There is a [plugin available](http://brakemanscanner.org/docs/jenkins/) for Jenk
 
 For even more continuous testing, try the [Guard plugin](https://github.com/guard/guard-brakeman).
 
-There are a couple [Github Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
+There are a couple [GitHub Actions](https://github.com/marketplace?type=actions&query=brakeman) available.
 
 # Building
 

data/bundle/load.rb

@@ -1,16 +1,16 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-3.19.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/temple-0.8.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/tilt-2.0.10/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/unicode-display_width-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/slim-4.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/highline-2.0.3/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby2ruby-2.4.4/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/haml-5.2.2/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/parallel-1.22.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/sexp_processor-4.16.1/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/ruby_parser-legacy-1.0.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib"
-$:.unshift "#{path}/bundle/ruby/2.7.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/csv-3.3.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/haml-5.2.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/highline-3.1.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/parallel-1.26.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/reline-0.6.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/rexml-3.4.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby2ruby-2.5.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-3.20.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/sexp_processor-4.17.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/slim-5.2.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/temple-0.10.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/terminal-table-3.0.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/tilt-2.5.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-display_width-2.6.0/lib"

data/bundle/ruby/3.1.0/gems/csv-3.3.2/LICENSE.txt

@@ -0,0 +1,33 @@
+Copyright (C) 2005-2016 James Edward Gray II. All rights reserved.
+Copyright (C) 2007-2017 Yukihiro Matsumoto. All rights reserved.
+Copyright (C) 2017 SHIBATA Hiroshi. All rights reserved.
+Copyright (C) 2017 Olivier Lacan. All rights reserved.
+Copyright (C) 2017 Espartaco Palma. All rights reserved.
+Copyright (C) 2017 Marcus Stollsteimer. All rights reserved.
+Copyright (C) 2017 pavel. All rights reserved.
+Copyright (C) 2017-2018 Steven Daniels. All rights reserved.
+Copyright (C) 2018 Tomohiro Ogoke. All rights reserved.
+Copyright (C) 2018 Kouhei Sutou. All rights reserved.
+Copyright (C) 2018 Mitsutaka Mimura. All rights reserved.
+Copyright (C) 2018 Vladislav. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.