brakeman 6.0.0 → 6.0.1

data/bundle/ruby/{3.0.0/gems/ruby_parser-3.20.1 → 3.1.0/gems/ruby_parser-3.20.3}/lib/ruby_parser.yy

@@ -1293,7 +1293,6 @@ rule
                 | k_begin
                     {
                       lexer.cmdarg.push false
-                      result = self.lexer.lineno
                     }
                     bodystmt k_end
                     {
@@ -1458,9 +1457,6 @@ rule
                       result = new_for iter, var, body
                     }
                 | k_class
-                    {
-                      result = self.lexer.lineno
-                    }
                     cpath superclass
                     {
                       if (self.in_def || self.in_single > 0) then
@@ -1475,9 +1471,6 @@ rule
                       self.lexer.ignore_body_comments
                     }
                 | k_class tLSHFT
-                    {
-                      result = self.lexer.lineno
-                    }
                     expr
                     {
                       result = self.in_def
@@ -1496,9 +1489,6 @@ rule
                       self.lexer.ignore_body_comments
                     }
                 | k_module
-                    {
-                      result = self.lexer.lineno
-                    }
                     cpath
                     {
                       yyerror "module definition in method body" if

data/bundle/ruby/{3.0.0/gems/ruby_parser-3.20.1 → 3.1.0/gems/ruby_parser-3.20.3}/lib/ruby_parser_extras.rb

@@ -30,9 +30,9 @@ class Sexp
 end
 
 module RubyParserStuff
-  VERSION = "3.20.1"
+  VERSION = "3.20.3"
 
-  attr_accessor :lexer, :in_def, :in_single, :file
+  attr_accessor :lexer, :in_def, :in_single, :file, :in_argdef
   attr_accessor :in_kwarg
   attr_reader :env, :comments
 
@@ -122,6 +122,7 @@ module RubyParserStuff
     self.lexer = RubyLexer.new v && v.to_i
     self.lexer.parser = self
     self.in_kwarg = false
+    self.in_argdef = false
 
     @env = RubyParserStuff::Environment.new
     @comments = []
@@ -824,10 +825,10 @@ module RubyParserStuff
   end
 
   def new_begin val
-    _, lineno, body, _ = val
+    (_, line), _, body, _ = val
 
     result = body ? s(:begin, body) : s(:nil)
-    result.line lineno
+    result.line line
 
     result
   end
@@ -928,8 +929,7 @@ module RubyParserStuff
   end
 
   def new_class val
-    # TODO: get line from class keyword
-    _, line, path, superclass, _, body, (_, line_max) = val
+    (_, line), path, superclass, _, body, (_, line_max) = val
 
     path = path.first if path.instance_of? Array
 
@@ -1209,7 +1209,7 @@ module RubyParserStuff
   end
 
   def new_module val
-    (_, line_min), _, path, _, body, (_, line_max) = val
+    (_, line_min), path, _, body, (_, line_max) = val
 
     path = path.first if path.instance_of? Array
 
@@ -1367,7 +1367,7 @@ module RubyParserStuff
   end
 
   def new_sclass val
-    recv, in_def, in_single, body = val[3], val[4], val[6], val[7]
+    (_, line), _, recv, in_def, _, in_single, body, _ = val
 
     result = s(:sclass, recv)
 
@@ -1379,7 +1379,7 @@ module RubyParserStuff
       end
     end
 
-    result.line = val[2]
+    result.line = line
     self.in_def = in_def
     self.in_single = in_single
     result

data/bundle/ruby/{3.0.0/gems/ruby_parser-3.20.1 → 3.1.0/gems/ruby_parser-3.20.3}/tools/munge.rb

@@ -174,6 +174,10 @@ ARGF.each_line do |line|
     last_token = token
   when /^Reading a token: / then
     next # skip
+  when /^Reading a token$/ then # wtf?
+    next # skip
+  when /^(?:add_delayed_token|parser_dispatch)/ then # dunno what this is yet
+    next # skip
   when /^read\s+:(\w+)/ then # read    :tNL(tNL) nil
     token = munge $1
     next if last_token == token
@@ -212,7 +216,9 @@ ARGF.each_line do |line|
     reduce_line = nil
     stack.clear
   when /^reduce/ then # ruby_parser side
-    puts munge line.chomp
+    s = munge line.chomp
+    next if s =~ /reduce\s+(\w+) --> \1/
+    puts s
     puts
   when /^(\w+_stack)\.(\w+)/ then
     # TODO: make pretty, but still informative w/ line numbers etc
@@ -223,7 +229,7 @@ ARGF.each_line do |line|
     # puts line
     # TODO: make pretty, but still informative w/ line numbers etc
     puts line.gsub("true", "1").gsub("false", "0")
-  when /^lex_state: :?([\w|]+) -> :?([\w|]+)(?: (?:at|from) (.*))?/ then
+  when /^lex_state: :?([\w|()]+) -> :?([\w|]+)(?: (?:at|from) (.*))?/ then
     a, b, c = $1.upcase, $2.upcase, $3
     a.gsub!(/EXPR_/, "")
     b.gsub!(/EXPR_/, "")

data/bundle/ruby/{3.0.0/gems/ruby_parser-3.20.1 → 3.1.0/gems/ruby_parser-3.20.3}/tools/ripper.rb

@@ -21,18 +21,20 @@ end
 ARGV.each do |path|
   src = path == "-" ? $stdin.read : File.read(path)
 
-  sexp = if $b then
-           Ripper.sexp src
-         else
-           rip = MySexpBuilder.new src
-           rip.yydebug = $d
-           rip.parse
-
-           if rip.error? then
-             warn "skipping"
-             next
-           end
-         end
+  sexp = nil
+
+  if $b then
+    sexp = Ripper.sexp src
+  else
+    rip = MySexpBuilder.new src
+    rip.yydebug = $d
+    sexp = rip.parse
+
+    if rip.error? then
+      warn "skipping"
+      next
+    end
+  end
 
   puts "accept"
 

data/lib/brakeman/tracker/config.rb

@@ -189,13 +189,19 @@ module Brakeman
     # Load defaults based on config.load_defaults value
     # as documented here: https://guides.rubyonrails.org/configuring.html#results-of-config-load-defaults
     def load_rails_defaults
-      return unless number? tracker.config.rails[:load_defaults]
+      return unless node_type? tracker.config.rails[:load_defaults], :lit, :str
+
+      version = tracker.config.rails[:load_defaults].value.to_s
+
+      unless version.match? /^\d+\.\d+$/
+        Brakeman.debug "[Notice] Unknown version: #{tracker.config.rails[:load_defaults]}"
+        return
+      end
 
-      version = tracker.config.rails[:load_defaults].value
       true_value = Sexp.new(:true)
       false_value = Sexp.new(:false)
 
-      if version >= 5.0
+      if version >= '5.0'
         set_rails_config(value: true_value, path: [:action_controller, :per_form_csrf_tokens])
         set_rails_config(value: true_value, path: [:action_controller, :forgery_protection_origin_check])
         set_rails_config(value: true_value, path: [:active_record, :belongs_to_required_by_default])
@@ -203,12 +209,12 @@ module Brakeman
         set_rails_config(value: true_value, path: [:ssl_options, :hsts, :subdomains])
       end
 
-      if version >= 5.1
+      if version >= '5.1'
         set_rails_config(value: false_value, path: [:assets, :unknown_asset_fallback])
         set_rails_config(value: true_value, path: [:action_view, :form_with_generates_remote_forms])
       end
 
-      if version >= 5.2
+      if version >= '5.2'
         set_rails_config(value: true_value, path: [:active_record, :cache_versioning])
         set_rails_config(value: true_value, path: [:action_dispatch, :use_authenticated_cookie_encryption])
         set_rails_config(value: true_value, path: [:active_support, :use_authenticated_message_encryption])
@@ -217,7 +223,7 @@ module Brakeman
         set_rails_config(value: true_value, path: [:action_view, :form_with_generates_ids])
       end
 
-      if version >= 6.0
+      if version >= '6.0'
         set_rails_config(value: Sexp.new(:lit, :zeitwerk), path: [:autoloader])
         set_rails_config(value: false_value, path: [:action_view, :default_enforce_utf8])
         set_rails_config(value: true_value, path: [:action_dispatch, :use_cookies_with_metadata])
@@ -230,7 +236,7 @@ module Brakeman
         set_rails_config(value: true_value, path: [:active_record, :collection_cache_versioning])
       end
 
-      if version >= 6.1
+      if version >= '6.1'
         set_rails_config(value: true_value, path: [:action_controller, :urlsafe_csrf_tokens])
         set_rails_config(value: Sexp.new(:lit, :lax), path: [:action_dispatch, :cookies_same_site_protection])
         set_rails_config(value: Sexp.new(:lit, 308), path: [:action_dispatch, :ssl_default_redirect_status])
@@ -242,7 +248,7 @@ module Brakeman
         set_rails_config(value: true_value, path: [:active_storage, :track_variants])
       end
 
-      if version >= 7.0
+      if version >= '7.0'
         video_args =
           Sexp.new(:str, "-vf 'select=eq(n\\,0)+eq(key\\,1)+gt(scene\\,0.015),loop=loop=-1:size=2,trim=start_frame=1' -frames:v 1 -f image2")
         hash_class = s(:colon2, s(:colon2, s(:const, :OpenSSL), :Digest), :SHA256)

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "6.0.0"
+  Version = "6.0.1"
 end