brakeman 5.4.1 → 6.0.0

data/bundle/ruby/{3.1.0/gems/ruby_parser-3.19.2 → 3.0.0/gems/ruby_parser-3.20.1}/lib/ruby3_parser.yy

@@ -4,6 +4,8 @@
 class Ruby30Parser
 #elif V == 31
 class Ruby31Parser
+#elif V == 32
+class Ruby32Parser
 #else
 fail "version not specified or supported on code generation"
 #endif
@@ -227,6 +229,7 @@ rule
                 | lhs tEQL mrhs
                     {
                       lhs, _, rhs = val
+
                       result = new_assign lhs, s(:svalue, rhs).line(rhs.line)
                     }
                 | mlhs tEQL mrhs_arg kRESCUE_MOD stmt
@@ -1146,8 +1149,10 @@ rule
 
       paren_args: tLPAREN2 opt_call_args rparen
                     {
-                      _, args, _ = val
+                      _, args, (_, line_max) = val
+
                       result = args
+                      result.line_max = line_max if args
                     }
                 | tLPAREN2 args tCOMMA args_forward rparen
                     {
@@ -1377,12 +1382,14 @@ rule
                     {
                       result = wrap :colon3, val[1]
                     }
-                | tLBRACK { result = lexer.lineno } aref_args tRBRACK
+                | tLBRACK { result = lexer.lineno } aref_args rbracket
                     {
-                      _, line, args, _ = val
+                      _, line, args, (_, line_max) = val
+
                       result = args || s(:array)
                       result.sexp_type = :array # aref_args is :args
                       result.line line
+                      result.line_max = line_max
                     }
                 | tLBRACE
                     {
@@ -1973,13 +1980,19 @@ opt_block_args_tail: tCOMMA block_args_tail
                     {
                       call, args = val
 
-                      result = call.concat args.sexp_body if args
+                      result = call
+
+                      if args then
+                        call.concat args.sexp_body
+                        result.line_max = args.line_max
+                      end
                     }
                 | primary_value call_op operation2 opt_paren_args
                     {
-                      recv, call_op, (op, _line), args = val
+                      recv, call_op, (op, op_line), args = val
 
                       result = new_call recv, op.to_sym, args, call_op
+                      result.line_max = op_line unless args
                     }
                 | primary_value tCOLON2 operation2 paren_args
                     {
@@ -2749,15 +2762,17 @@ opt_block_args_tail: tCOMMA block_args_tail
 
            words: tWORDS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tWORDS_BEG word_list tSTRING_END
                     {
-                      (_, line), list, _ = val
+                      (_, line), list, (_, line_max) = val
 
                       result = list.line line
+                      result.line_max = line_max
                     }
 
        word_list: none
@@ -2777,15 +2792,17 @@ opt_block_args_tail: tCOMMA block_args_tail
 
          symbols: tSYMBOLS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tSYMBOLS_BEG symbol_list tSTRING_END
                     {
-                      (_, line), list, _, = val
-                      list.line line
-                      result = list
+                      (_, line), list, (_, line_max), = val
+
+                      result = list.line line
+                      result.line_max = line_max
                     }
 
      symbol_list: none
@@ -2800,28 +2817,32 @@ opt_block_args_tail: tCOMMA block_args_tail
 
           qwords: tQWORDS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tQWORDS_BEG qword_list tSTRING_END
                     {
-                      (_, line), list, _ = val
+                      (_, line), list, (_, line_max) = val
 
                       result = list.line line
+                      result.line_max = line_max
                     }
 
         qsymbols: tQSYMBOLS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tQSYMBOLS_BEG qsym_list tSTRING_END
                     {
-                      (_, line), list, _ = val
+                      (_, line), list, (_, line_max) = val
 
                       result = list.line line
+                      result.line_max = line_max
                     }
 
       qword_list: none
@@ -3257,7 +3278,14 @@ f_opt_paren_args: f_paren_args
                         result = s(:args, list).line list.line
                       end
 
-                      result << (Sexp === item ? item : item.first)
+                      if Sexp === item then
+                        line_max = item.line_max
+                      else
+                        item, line_max = item
+                      end
+
+                      result << item
+                      result.line_max = line_max
                     }
 
          f_label: tLABEL

data/bundle/ruby/{3.1.0/gems/ruby_parser-3.19.2 → 3.0.0/gems/ruby_parser-3.20.1}/lib/ruby_parser.rb

@@ -81,10 +81,12 @@ require "ruby26_parser"
 require "ruby27_parser"
 require "ruby30_parser"
 require "ruby31_parser"
+require "ruby32_parser"
 
 class RubyParser # HACK
   VERSIONS.clear # also a HACK caused by racc namespace issues
 
+  class V32 < ::Ruby32Parser; end
   class V31 < ::Ruby31Parser; end
   class V30 < ::Ruby30Parser; end
   class V27 < ::Ruby27Parser; end

data/bundle/ruby/{3.1.0/gems/ruby_parser-3.19.2 → 3.0.0/gems/ruby_parser-3.20.1}/lib/ruby_parser.yy

@@ -253,6 +253,7 @@ rule
                 | lhs tEQL mrhs
                     {
                       lhs, _, rhs = val
+
                       result = new_assign lhs, s(:svalue, rhs).line(rhs.line)
                     }
 #if V == 20
@@ -1107,8 +1108,10 @@ rule
 
       paren_args: tLPAREN2 opt_call_args rparen
                     {
-                      _, args, _ = val
+                      _, args, (_, line_max) = val
+
                       result = args
+                      result.line_max = line_max if args
                     }
 #if V >= 27
                 | tLPAREN2 args tCOMMA args_forward rparen
@@ -1335,12 +1338,14 @@ rule
                     {
                       result = wrap :colon3, val[1]
                     }
-                | tLBRACK { result = lexer.lineno } aref_args tRBRACK
+                | tLBRACK { result = lexer.lineno } aref_args rbracket
                     {
-                      _, line, args, _ = val
+                      _, line, args, (_, line_max) = val
+
                       result = args || s(:array)
                       result.sexp_type = :array # aref_args is :args
                       result.line line
+                      result.line_max = line_max
                     }
                 | tLBRACE
                     {
@@ -1942,13 +1947,19 @@ opt_block_args_tail: tCOMMA block_args_tail
                     {
                       call, args = val
 
-                      result = call.concat args.sexp_body if args
+                      result = call
+
+                      if args then
+                        call.concat args.sexp_body
+                        result.line_max = args.line_max
+                      end
                     }
                 | primary_value call_op operation2 opt_paren_args
                     {
-                      recv, call_op, (op, _line), args = val
+                      recv, call_op, (op, op_line), args = val
 
                       result = new_call recv, op.to_sym, args, call_op
+                      result.line_max = op_line unless args
                     }
                 | primary_value tCOLON2 operation2 paren_args
                     {
@@ -2674,15 +2685,17 @@ opt_block_args_tail: tCOMMA block_args_tail
 
            words: tWORDS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tWORDS_BEG word_list tSTRING_END
                     {
-                      (_, line), list, _ = val
+                      (_, line), list, (_, line_max) = val
 
                       result = list.line line
+                      result.line_max = line_max
                     }
 
        word_list: none
@@ -2702,15 +2715,17 @@ opt_block_args_tail: tCOMMA block_args_tail
 
          symbols: tSYMBOLS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tSYMBOLS_BEG symbol_list tSTRING_END
                     {
-                      (_, line), list, _, = val
-                      list.line line
-                      result = list
+                      (_, line), list, (_, line_max), = val
+
+                      result = list.line line
+                      result.line_max = line_max
                     }
 
      symbol_list: none
@@ -2725,28 +2740,32 @@ opt_block_args_tail: tCOMMA block_args_tail
 
           qwords: tQWORDS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tQWORDS_BEG qword_list tSTRING_END
                     {
-                      (_, line), list, _ = val
+                      (_, line), list, (_, line_max) = val
 
                       result = list.line line
+                      result.line_max = line_max
                     }
 
         qsymbols: tQSYMBOLS_BEG tSPACE tSTRING_END
                     {
-                      (_, line), _, _ = val
+                      (_, line), _, (_, line_max) = val
 
                       result = s(:array).line line
+                      result.line_max = line_max
                     }
                 | tQSYMBOLS_BEG qsym_list tSTRING_END
                     {
-                      (_, line), list, _ = val
+                      (_, line), list, (_, line_max) = val
 
                       result = list.line line
+                      result.line_max = line_max
                     }
 
       qword_list: none
@@ -3197,7 +3216,14 @@ keyword_variable: kNIL      { result = s(:nil).line lexer.lineno }
                         result = s(:args, list).line list.line
                       end
 
-                      result << (Sexp === item ? item : item.first)
+                      if Sexp === item then
+                        line_max = item.line_max
+                      else
+                        item, line_max = item
+                      end
+
+                      result << item
+                      result.line_max = line_max
                     }
 
 #if V == 20
@@ -3449,7 +3475,15 @@ keyword_variable: kNIL      { result = s(:nil).line lexer.lineno }
        opt_terms:  | terms
           opt_nl:  | tNL
           rparen: opt_nl tRPAREN
+                    {
+                      _, close = val
+                      result = [close, lexer.lineno]
+                    }
         rbracket: opt_nl tRBRACK
+                    {
+                      _, close = val
+                      result = [close, lexer.lineno]
+                    }
 #if V >= 27
           rbrace: opt_nl tRCURLY
 #endif

data/bundle/ruby/{3.1.0/gems/ruby_parser-3.19.2 → 3.0.0/gems/ruby_parser-3.20.1}/lib/ruby_parser_extras.rb

@@ -18,7 +18,7 @@ class Sexp
   end
 
   ##
-  # Returns the maximum line number of the children of self.
+  # Returns the minimum line number of the children of self.
 
   def line_min
     @line_min ||= [self.deep_each.map(&:line).min, self.line].compact.min
@@ -30,7 +30,7 @@ class Sexp
 end
 
 module RubyParserStuff
-  VERSION = "3.19.2"
+  VERSION = "3.20.1"
 
   attr_accessor :lexer, :in_def, :in_single, :file
   attr_accessor :in_kwarg
@@ -153,6 +153,7 @@ module RubyParserStuff
       result.line lexer.lineno
     else
       result.line ss.first.line
+      result.line_max = ss.first.line_max
     end
 
     args.each do |arg|
@@ -330,9 +331,8 @@ module RubyParserStuff
     end
 
     args.each do |arg|
-      if arg.instance_of? Array and arg.size == 2 and arg.last.is_a? Numeric then
-        arg = arg.first
-      end
+      # ruby 3.0+ TODO: next if arg in [String, Integer] # eg ["(", 1]
+      next if arg.class == Array && arg.map(&:class) == [String, Integer]
 
       case arg
       when Sexp then
@@ -794,6 +794,7 @@ module RubyParserStuff
     case lhs.sexp_type
     when :lasgn, :iasgn, :cdecl, :cvdecl, :gasgn, :cvasgn, :attrasgn, :safe_attrasgn then
       lhs << rhs
+      lhs.line_max = rhs.line_max
     when :const then
       lhs.sexp_type = :cdecl
       lhs << rhs
@@ -885,12 +886,13 @@ module RubyParserStuff
     # TODO: need a test with f(&b) to produce block_pass
     # TODO: need a test with f(&b) { } to produce warning
 
-    if args
+    if args then
       if ARG_TYPES[args.sexp_type] then
         result.concat args.sexp_body
       else
         result << args
       end
+      result.line_max = args.line_max
     end
 
     # line = result.grep(Sexp).map(&:line).compact.min
@@ -927,7 +929,7 @@ module RubyParserStuff
 
   def new_class val
     # TODO: get line from class keyword
-    line, path, superclass, body = val[1], val[2], val[3], val[5]
+    _, line, path, superclass, _, body, (_, line_max) = val
 
     path = path.first if path.instance_of? Array
 
@@ -942,6 +944,7 @@ module RubyParserStuff
     end
 
     result.line = line
+    result.line_max = line_max
     result.comments = self.comments.pop
     result
   end
@@ -970,13 +973,14 @@ module RubyParserStuff
   end
 
   def new_defn val
-    _, (name, line), in_def, args, body, _ = val
+    _, (name, line), in_def, args, body, (_, line_max) = val
 
     body ||= s(:nil).line line
 
     args.line line
 
     result = s(:defn, name.to_sym, args).line line
+    result.line_max = line_max
 
     if body.sexp_type == :block then
       result.push(*body.sexp_body)
@@ -1033,13 +1037,14 @@ module RubyParserStuff
   end
 
   def new_defs val
-    _, recv, (name, line), in_def, args, body, _ = val
+    _, recv, (name, line), in_def, args, body, (_, line_max) = val
 
     body ||= s(:nil).line line
 
     args.line line
 
     result = s(:defs, recv, name.to_sym, args).line line
+    result.line_max = line_max
 
     # TODO: remove_begin
     # TODO: reduce_nodes
@@ -1204,12 +1209,12 @@ module RubyParserStuff
   end
 
   def new_module val
-    # TODO: get line from module keyword
-    line, path, body = val[1], val[2], val[4]
+    (_, line_min), _, path, _, body, (_, line_max) = val
 
     path = path.first if path.instance_of? Array
 
-    result = s(:module, path).line line
+    result = s(:module, path).line line_min
+    result.line_max = line_max
 
     if body then # REFACTOR?
       if body.sexp_type == :block then
@@ -1291,9 +1296,10 @@ module RubyParserStuff
   end
 
   def new_regexp val
-    (_, line), node, (options, _) = val
+    (_, line), node, (options, line_max) = val
 
     node ||= s(:str, "").line line
+    node.line_max = line_max
 
     o, k = 0, nil
     options.split(//).uniq.each do |c| # FIX: this has a better home

data/bundle/ruby/{3.1.0/gems/sexp_processor-4.16.1 → 3.0.0/gems/sexp_processor-4.17.0}/History.rdoc

@@ -1,3 +1,16 @@
+=== 4.17.0 / 2023-05-03
+
+* 2 minor enhancements:
+
+  * Added Sexp#line_max=.
+  * Will load strict_sexp if $SP_DEBUG is set.
+
+* 3 bug fixes:
+
+  * Sexp#line_max lazy accessor now compacts.
+  * Sexp#new copies line_max if defined.
+  * strict_sexp.rb: #first can take an int arg. Fixed mutator wrappers to pass args.
+
 === 4.16.1 / 2022-04-09
 
 * 1 minor enhancement:

data/bundle/ruby/{3.1.0/gems/sexp_processor-4.16.1 → 3.0.0/gems/sexp_processor-4.17.0}/lib/pt_testcase.rb

@@ -34,7 +34,7 @@ class Examples
 end
 
 class ParseTreeTestCase < Minitest::Test
-  all_versions  = %w[18 19 20 21 22 23 24 25 26 27 30 31]
+  all_versions  = %w[18 19 20 21 22 23 24 25 26 27 30 31 32]
   most_versions = all_versions.drop(1)
 
   TEST_SUFFIX = "_#{most_versions.join "_"}"
@@ -1072,7 +1072,7 @@ class ParseTreeTestCase < Minitest::Test
             "Ruby2Ruby"    => "-(2 ** 31)")
 
   add_tests("case",
-            "Ruby"         => "var = 2\nresult = \"\"\ncase var\nwhen 1 then\n  puts(\"something\")\n  result = \"red\"\nwhen 2, 3 then\n  result = \"yellow\"\nwhen 4 then\n  # do nothing\nelse\n  result = \"green\"\nend\ncase result\nwhen \"red\" then\n  var = 1\nwhen \"yellow\" then\n  var = 2\nwhen \"green\" then\n  var = 3\nelse\n  # do nothing\nend\n",
+            "Ruby"         => "var = 2\nresult = \"\"\ncase var\nwhen 1 then\n  puts(\"something\")\n  result = \"red\"\nwhen 2, 3 then\n  result = \"yellow\"\nwhen 4 then\n  # do nothing\nelse\n  result = \"green\"\nend\ncase result\nwhen \"red\" then\n  var = 1\nwhen \"yellow\" then\n  var = 2\nwhen \"green\" then\n  var = 3\nend\n",
             "ParseTree"    => s(:block,
                                 s(:lasgn, :var, s(:lit, 2)),
                                 s(:lasgn, :result, s(:str, "")),
@@ -1124,7 +1124,7 @@ class ParseTreeTestCase < Minitest::Test
                                   s(:lasgn, :result, s(:lit, 7)))))
 
   add_tests("case_nested_inner_no_expr",
-            "Ruby"         => "case a\nwhen b then\n  case\n  when (d and e) then\n    f\n  else\n    # do nothing\n  end\nelse\n  # do nothing\nend",
+            "Ruby"         => "case a\nwhen b then\n  case\n  when (d and e) then\n    f\n  end\nend",
             "ParseTree"    => s(:case, s(:call, nil, :a),
                                 s(:when,
                                   s(:array, s(:call, nil, :b)),

data/bundle/ruby/{3.1.0/gems/sexp_processor-4.16.1 → 3.0.0/gems/sexp_processor-4.17.0}/lib/sexp.rb

@@ -12,6 +12,11 @@ class Sexp < Array # ZenTest FULL
 
   attr_writer :line
 
+  ##
+  # Set the maximum line number for this sexp. Often set by ruby_parser.
+
+  attr_writer :line_max
+
   ##
   # Accessors for the file. Usually set by ruby_parser.
 
@@ -59,6 +64,7 @@ class Sexp < Array # ZenTest FULL
     r = self.class.new._concat(body) # ensures a sexp from map
     r.file     = self.file     if self.file
     r.line     = self.line     if self.line
+    r.line_max = self.line_max if defined?(@line_max)
     r.comments = self.comments if self.comments
     r
   end
@@ -233,7 +239,7 @@ class Sexp < Array # ZenTest FULL
   # Returns the maximum line number of the children of self.
 
   def line_max
-    @line_max ||= self.deep_each.map(&:line).max
+    @line_max ||= self.deep_each.map(&:line).compact.max
   end
 
   ##
@@ -388,4 +394,4 @@ def s *args, &blk
 end
 
 require "sexp_matcher" unless defined? Sexp::Matcher
-require "strict_sexp" if ENV["STRICT_SEXP"].to_i > 0
+require "strict_sexp" if ENV["SP_DEBUG"] || ENV["STRICT_SEXP"].to_i > 0

data/bundle/ruby/{3.1.0/gems/sexp_processor-4.16.1 → 3.0.0/gems/sexp_processor-4.17.0}/lib/sexp_processor.rb

@@ -34,7 +34,7 @@ require "sexp"
 class SexpProcessor
 
   # duh
-  VERSION = "4.16.1"
+  VERSION = "4.17.0"
 
   ##
   # Automatically shifts off the Sexp type before handing the

data/bundle/ruby/{3.1.0/gems/sexp_processor-4.16.1 → 3.0.0/gems/sexp_processor-4.17.0}/lib/strict_sexp.rb

@@ -83,8 +83,9 @@ class Sexp
     self.safe_asgn i, v
   end
 
-  def first
-    raise "use sexp_type"
+  def first(n = nil)
+    raise "use sexp_type" unless n
+    super
   end
 
   nuke_method :collect!, 4
@@ -136,10 +137,10 @@ if ENV["SP_DEBUG"] && !ENV["STRICT_SEXP"] then
                  ]
 
     mutators.each do |method|
-      define_method method do |*|
+      define_method method do |*args|
         warn "Sexp modified by %p at %s" % [__method__, caller.first] if
-          $VERBOSE or (defined?(@hash) and @hash)
-        super
+          ENV["VERBOSE"] or (defined?(@hash) and @hash)
+        super(*args)
       end
     end
   end

data/lib/brakeman/app_tree.rb

@@ -197,7 +197,6 @@ module Brakeman
       spec/
       test/
       tmp/
-      public/
       log/
     ]
 

data/lib/brakeman/checks/check_content_tag.rb

@@ -73,11 +73,14 @@ class Brakeman::CheckContentTag < Brakeman::CheckCrossSiteScripting
       check_argument result, content
     end
 
-    #Attribute keys are never escaped, so check them for user input
-    if not @matched and hash? attributes and not request_value? attributes
-      hash_iterate(attributes) do |k, _v|
-        check_argument result, k
-        return if @matched
+    # This changed in Rails 6.1.6
+    if version_between? '0.0.0', '6.1.5' 
+      #Attribute keys are never escaped, so check them for user input
+      if not @matched and hash? attributes and not request_value? attributes
+        hash_iterate(attributes) do |k, _v|
+          check_argument result, k
+          return if @matched
+        end
       end
     end
 

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -21,6 +21,8 @@ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
     ['2.5.0', '2.5.99'] => Date.new(2021, 3, 31),
     ['2.6.0', '2.6.99'] => Date.new(2022, 3, 31),
     ['2.7.0', '2.7.99'] => Date.new(2023, 3, 31),
-    ['3.0.0', '2.8.99'] => Date.new(2024, 3, 31),
+    ['3.0.0', '3.0.99'] => Date.new(2024, 3, 31),
+    ['3.1.0', '3.1.99'] => Date.new(2025, 3, 31),
+    ['3.2.0', '3.2.99'] => Date.new(2026, 3, 31),
   }
 end

data/lib/brakeman/report/report_github.rb

@@ -1,4 +1,4 @@
-# Github Actions Formatter
+# GitHub Actions Formatter
 # Formats warnings as workflow commands to create annotations in GitHub UI
 class Brakeman::Report::Github < Brakeman::Report::Base
   def generate_report

data/lib/brakeman/scanner.rb

@@ -1,6 +1,5 @@
 begin
   Brakeman.load_brakeman_dependency 'ruby_parser'
-  Brakeman.load_brakeman_dependency 'ruby_parser/legacy'
   require 'ruby_parser/bm_sexp.rb'
   require 'ruby_parser/bm_sexp_processor.rb'
   require 'brakeman/processor'

data/lib/brakeman/tracker/config.rb

@@ -20,9 +20,7 @@ module Brakeman
 
     def default_protect_from_forgery?
       if version_between? "5.2.0.beta1", "9.9.9"
-        if @rails.dig(:action_controller, :default_protect_from_forgery) == Sexp.new(:false)
-          return false
-        else
+        if @rails.dig(:action_controller, :default_protect_from_forgery) == Sexp.new(:true)
           return true
         end
       end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "5.4.1"
+  Version = "6.0.0"
 end