brakeman 5.2.3 → 7.0.0

data/lib/brakeman/processors/lib/module_helper.rb

@@ -84,6 +84,9 @@ module Brakeman::ModuleHelper
     res.line(exp.line)
     @current_method = nil
 
+    # TODO: if target is not self/nil, then
+    # the method should be added to `target`, not current class
+
     if @current_class
       @current_class.add_method @visibility, name, res, @current_file
     elsif @current_module
@@ -96,7 +99,13 @@ module Brakeman::ModuleHelper
     name = exp.method_name
 
     @current_method = name
-    res = Sexp.new :defn, name, exp.formal_args, *process_all!(exp.body)
+
+    if @inside_sclass
+      res = Sexp.new :defs, s(:self), name, exp.formal_args, *process_all!(exp.body)
+    else
+      res = Sexp.new :defn, name, exp.formal_args, *process_all!(exp.body)
+    end
+
     res.line(exp.line)
     @current_method = nil
 
@@ -108,4 +117,25 @@ module Brakeman::ModuleHelper
 
     res
   end
+
+  # class << self
+  def process_sclass exp
+    @inside_sclass = true
+
+    process_all! exp
+
+    exp
+  ensure
+    @inside_sclass = false
+  end
+
+  def make_defs exp
+    # 'What if' there was some crazy code that had a
+    # defs inside a def inside an sclass? :|
+    return exp if node_type? exp, :defs
+
+    raise "Unexpected node type: #{exp.node_type}" unless node_type? exp, :defn
+
+    Sexp.new(:defs, s(:self), exp.method_name, exp.formal_args, *exp.body).line(exp.line)
+  end
 end

data/lib/brakeman/processors/lib/rails3_config_processor.rb

@@ -86,7 +86,7 @@ class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
       end
     elsif include_rails_config? exp
       options_path = get_rails_config exp
-      @tracker.config.set_rails_config(exp.first_arg, *options_path)
+      @tracker.config.set_rails_config(value: exp.first_arg, path: options_path, overwrite: true)
     end
 
     exp

data/lib/brakeman/processors/library_processor.rb

@@ -30,6 +30,12 @@ class Brakeman::LibraryProcessor < Brakeman::BaseProcessor
   end
 
   def process_defn exp
+    # TODO: Why is this different from ModuleHelper?
+
+    if @inside_sclass
+      exp = make_defs(exp)
+    end
+
     if exp.method_name == :initialize
       @alias_processor.process_safely exp.body_list
       @initializer_env = @alias_processor.only_ivars

data/lib/brakeman/report/ignore/config.rb

@@ -130,7 +130,6 @@ module Brakeman
 
       output = {
         :ignored_warnings => warnings,
-        :updated => Time.now.to_s,
         :brakeman_version => Brakeman::Version
       }
 

data/lib/brakeman/report/pager.rb

@@ -52,7 +52,7 @@ module Brakeman
     def page_via_less text
       # Adapted from https://github.com/piotrmurach/tty-pager/
 
-      write_io = open("|less #{less_options.join}", 'w')
+      write_io = IO.popen("less #{less_options.join}", 'w')
       pid = write_io.pid
 
       write_io.write(text)

data/lib/brakeman/report/report_codeclimate.rb

@@ -73,7 +73,7 @@ class Brakeman::Report::CodeClimate < Brakeman::Report::Base
     if tracker.options[:path_prefix]
       (Pathname.new(tracker.options[:path_prefix]) + Pathname.new(warning.file.relative)).to_s
     else
-      warning.file
+      warning.relative_path
     end
   end
 end

data/lib/brakeman/report/report_csv.rb

@@ -5,6 +5,7 @@ class Brakeman::Report::CSV < Brakeman::Report::Base
     headers = [
       "Confidence",
       "Warning Type",
+      "CWE",
       "File",
       "Line",
       "Message",
@@ -35,6 +36,7 @@ class Brakeman::Report::CSV < Brakeman::Report::Base
     [
       warning.confidence_name,
       warning.warning_type,
+      warning.cwe_id.first,
       warning_file(warning),
       warning.line,
       warning.message,

data/lib/brakeman/report/report_github.rb

@@ -1,4 +1,4 @@
-# Github Actions Formatter
+# GitHub Actions Formatter
 # Formats warnings as workflow commands to create annotations in GitHub UI
 class Brakeman::Report::Github < Brakeman::Report::Base
   def generate_report

data/lib/brakeman/report/report_junit.rb

@@ -1,6 +1,6 @@
 require 'time'
-require "stringio"
-require 'rexml/document'
+require 'stringio'
+Brakeman.load_brakeman_dependency 'rexml/document'
 
 class Brakeman::Report::JUnit < Brakeman::Report::Base
   def generate_report

data/lib/brakeman/report/report_markdown.rb

@@ -27,7 +27,7 @@ class Brakeman::Report::Markdown < Brakeman::Report::Table
   end
 
   def generate_report
-    out = "# BRAKEMAN REPORT\n\n" <<
+    out = +"# BRAKEMAN REPORT\n\n" <<
     generate_metadata.to_s << "\n\n" <<
     generate_checks.to_s << "\n\n" <<
     "### SUMMARY\n\n" <<

data/lib/brakeman/report/report_sarif.rb

@@ -1,8 +1,10 @@
+require 'uri'
+
 class Brakeman::Report::SARIF < Brakeman::Report::Base
   def generate_report
     sarif_log = {
       :version => '2.1.0',
-      :$schema => 'https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0-rtm.5.json',
+      :$schema => 'https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json',
       :runs => runs,
     }
     JSON.pretty_generate sarif_log
@@ -20,10 +22,122 @@ class Brakeman::Report::SARIF < Brakeman::Report::Base
           },
         },
         :results => results,
-      },
+      }.merge(original_uri_base_ids)
     ]
   end
 
+  # Output base URIs
+  # based on what the user specified for the application path
+  # and whether or not --absolute-paths was set.
+  def original_uri_base_ids
+    if tracker.options[:app_path] == '.'
+      # Probably no app_path was specified, as that's the default
+
+      if absolute_paths?
+        # Set %SRCROOT% to absolute path
+        {
+          originalUriBaseIds: {
+            '%SRCROOT%' => {
+              uri: file_uri(tracker.app_tree.root),
+              description: {
+                text: 'Base path for application'
+              }
+            }
+          }
+        }
+      else
+        # Empty %SRCROOT%
+        # This avoids any paths appearing in the report
+        # that are not part of the application directory.
+        # Seems fine!
+        {
+          originalUriBaseIds: {
+            '%SRCROOT%' => {
+              description: {
+                text: 'Base path for application'
+              }
+            },
+          }
+        }
+
+      end
+    elsif tracker.options[:app_path] != tracker.app_tree.root
+      # Path was specified and it was relative
+
+      if absolute_paths?
+        # Include absolute root and relative application path
+        {
+          originalUriBaseIds: {
+            PROJECTROOT: {
+              uri: file_uri(tracker.app_tree.root),
+              description: {
+                text: 'Base path for all project files'
+              }
+            },
+            '%SRCROOT%' => {
+              # Technically should ensure this doesn't have any '..'
+              # but... TODO
+              uri: File.join(tracker.options[:app_path], '/'),
+              uriBaseId: 'PROJECTROOT',
+              description: {
+                text: 'Base path for application'
+              }
+            }
+          }
+        }
+      else
+        # Just include relative application path.
+        # Not clear this is 100% valid, but there is one example in the spec like this
+        {
+          originalUriBaseIds: {
+            PROJECTROOT: {
+              description: {
+                text: 'Base path for all project files'
+              }
+            },
+            '%SRCROOT%' => {
+              # Technically should ensure this doesn't have any '..'
+              # but... TODO
+              uri: File.join(tracker.options[:app_path], '/'),
+              uriBaseId: 'PROJECTROOT',
+              description: {
+                text: 'Base path for application'
+              }
+            }
+          }
+        }
+      end
+    else
+      # app_path was absolute
+
+      if absolute_paths?
+        # Set %SRCROOT% to absolute path
+        {
+          originalUriBaseIds: {
+            '%SRCROOT%' => {
+              uri: file_uri(tracker.app_tree.root),
+              description: {
+                text: 'Base path for application'
+              }
+            }
+          }
+        }
+      else
+        # Empty %SRCROOT%
+        # Seems fine!
+        {
+          originalUriBaseIds: {
+            '%SRCROOT%' => {
+              description: {
+                text: 'Base path for application'
+              }
+            },
+          }
+        }
+      end
+    end
+  end
+
   def rules
     @rules ||= unique_warnings_by_warning_code.map do |warning|
       rule_id = render_id warning
@@ -130,4 +244,10 @@ class Brakeman::Report::SARIF < Brakeman::Report::Base
     })
     @@levels_from_confidence[warning.confidence]
   end
+
+  # File URI as a string with trailing forward-slash
+  # as required by SARIF standard
+  def file_uri(path)
+    URI::File.build(path: File.join(path, '/')).to_s
+  end
 end

data/lib/brakeman/report/report_table.rb

@@ -8,7 +8,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
 
   def generate_report
     summary_option = tracker.options[:summary_only]
-    out = ""
+    out = +""
 
     unless summary_option == :no_summary
       out << text_header <<
@@ -98,7 +98,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings generic_warnings,
                     :warning,
                     'security_warnings',
-                    ["Confidence", "Class", "Method", "Warning Type", "Message"],
+                    ["Confidence", "Class", "Method", "Warning Type", "CWE ID", "Message"],
                     'Class'
   end
 
@@ -107,7 +107,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings template_warnings,
                     :template,
                     'view_warnings',
-                    ['Confidence', 'Template', 'Warning Type', 'Message'],
+                    ['Confidence', 'Template', 'Warning Type', "CWE ID", 'Message'],
                     'Template'
 
   end
@@ -117,7 +117,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings model_warnings,
                     :model,
                     'model_warnings',
-                    ['Confidence', 'Model', 'Warning Type', 'Message'],
+                    ['Confidence', 'Model', 'Warning Type', "CWE ID", 'Message'],
                     'Model'
   end
 
@@ -126,7 +126,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings controller_warnings,
                     :controller,
                     'controller_warnings',
-                    ['Confidence', 'Controller', 'Warning Type', 'Message'],
+                    ['Confidence', 'Controller', 'Warning Type', "CWE ID", 'Message'],
                     'Controller'
   end
 
@@ -134,7 +134,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
     render_warnings ignored_warnings,
                     :ignored,
                     'ignored_warnings',
-                    ['Confidence', 'Warning Type', 'File', 'Message'],
+                    ['Confidence', 'Warning Type', "CWE ID", 'File', 'Message'],
                     'Warning Type'
   end
 
@@ -166,7 +166,7 @@ class Brakeman::Report::Table < Brakeman::Report::Base
 
     template_rows = template_rows.sort_by{|name, value| name.to_s}
 
-    output = ''
+    output = +''
     template_rows.each do |template|
       output << template.first.to_s << "\n\n"
       table = @table.new(:headings => ['Output']) do |t|

data/lib/brakeman/report/report_tabs.rb

@@ -9,7 +9,6 @@ class Brakeman::Report::Tabs < Brakeman::Report::Table
 
       self.send(meth).map do |w|
         line = w.line || 0
-        w.warning_type.gsub!(/[^\w\s]/, ' ')
         "#{(w.file.absolute)}\t#{line}\t#{w.warning_type}\t#{category}\t#{w.format_message}\t#{w.confidence_name}"
       end.join "\n"
 

data/lib/brakeman/report/report_text.rb

@@ -4,7 +4,7 @@ class Brakeman::Report::Text < Brakeman::Report::Base
   def generate_report
     HighLine.use_color = !!tracker.options[:output_color]
     summary_option = tracker.options[:summary_only]
-    @output_string = "\n"
+    @output_string = +"\n"
 
     unless summary_option == :no_summary
       add_chunk generate_header
@@ -21,6 +21,9 @@ class Brakeman::Report::Text < Brakeman::Report::Base
     add_chunk generate_obsolete
     add_chunk generate_errors
     add_chunk generate_warnings
+    add_chunk generate_show_ignored_overview if tracker.options[:show_ignored] && ignored_warnings.any?
+
+    @output_string
   end
 
   def add_chunk chunk, out = @output_string
@@ -101,6 +104,10 @@ class Brakeman::Report::Text < Brakeman::Report::Base
     end
   end
 
+  def generate_show_ignored_overview
+    double_space("Ignored Warnings", ignored_warnings.map {|w| output_warning w})
+  end
+
   def generate_errors
     return if tracker.errors.empty?
     full_trace = tracker.options[:debug]
@@ -159,6 +166,8 @@ class Brakeman::Report::Text < Brakeman::Report::Base
       label('Confidence', confidence(w.confidence))
     when :category
       label('Category', w.warning_type.to_s)
+    when :cwe
+      label('CWE', w.cwe_id.join(', '))
     when :check
       label('Check', w.check_name)
     when :message

data/lib/brakeman/report/templates/controller_warnings.html.erb

@@ -5,6 +5,7 @@
       <th>Confidence</th>
       <th>Controller</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -14,6 +15,7 @@
       <td><%= warning['Confidence']%></td>
       <td><%= warning['Controller']%></td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>

data/lib/brakeman/report/templates/ignored_warnings.html.erb

@@ -6,6 +6,7 @@
         <th>Confidence</th>
         <th>File</th>
         <th>Warning Type</th>
+        <th>CWE ID</th>
         <th>Message</th>
         <th>Note</th>
       </tr>
@@ -16,6 +17,7 @@
         <td><%= warning['Confidence']%></td>
         <td><%= warning['File']%></td>
         <td><%= warning['Warning Type']%></td>
+        <td><%= warning['CWE ID']%></td>
         <td><%= warning['Message']%></td>
         <td><%= warning['Note']%></td>
       </tr>

data/lib/brakeman/report/templates/model_warnings.html.erb

@@ -5,6 +5,7 @@
       <th>Confidence</th>
       <th>Model</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -14,6 +15,7 @@
       <td><%= warning['Confidence']%></td>
       <td><%= warning['Model']%></td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>

data/lib/brakeman/report/templates/security_warnings.html.erb

@@ -6,6 +6,7 @@
       <th>Class</th>
       <th>Method</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -16,6 +17,7 @@
       <td><%= warning['Class']%></td>
       <td><%= warning['Method']%></td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>

data/lib/brakeman/report/templates/view_warnings.html.erb

@@ -5,6 +5,7 @@
       <th>Confidence</th>
       <th>Template</th>
       <th>Warning Type</th>
+      <th>CWE ID</th>
       <th>Message</th>
     </tr>
   </thead>
@@ -27,6 +28,7 @@
         <% end %>
       </td>
       <td><%= warning['Warning Type']%></td>
+      <td><%= warning['CWE ID']%></td>
       <td><%= warning['Message']%></td>
     </tr>
   <% end %>