brakeman 6.0.0 → 6.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b7e53f6599afbe4c019377ebbc80680436b7ade712042bbc157337849077d62
-  data.tar.gz: cc29d28ed39810c40c06afce064873e68a150c81ff4111da526ec1c6fd1ef3d9
+  metadata.gz: 52bfaf604bda47973161eb7bb9fd6d1dd2aa7e4d280561b282e68d41e738856d
+  data.tar.gz: 80718f17fda4fb4b405a238f54476e5d400aa8e8af15e4a4527860f3a4fb15dc
 SHA512:
-  metadata.gz: 2ce1360cc6ee62f25abb4d62760a6f66c8c3b22e75c70d8a9d73dc47c485566d14d547a5dc4f663356fc1b71026cbf32bf92bf41040c563b963f9bf0fcdc810c
-  data.tar.gz: 5f2899652609070291d3368cdfc8e57781397dfe91cac0b6e78a33fa4822b36ad5701a8220138b6b518fca2c6b77c71273a85fb7bea1b29856ee00f29dbe4612
+  metadata.gz: 619b6e399bc20989df267e7d3485ba785507aa3a7e459708abf0ba9922ef073ab056946e569228b30d6edba620231de3b337b414ca5102922d479a12c4bf93b8
+  data.tar.gz: ff2f0f6a6df45abe51acbb304c525276a285235054c498d06967331ffc586980f1ec2d98b00ffc5bbaaaf808d0dfb36fdc7ba90ed621c3088a6871f2195b120a

data/CHANGES.md

@@ -1,3 +1,16 @@
+# 6.1.0 - 2023-12-04
+
+* Add `--timing` to add timing duration for scan steps
+* Fix keyword splats in filter arguments
+* Add check for unfiltered search with Ransack
+* Fix class method lookup in parent classes
+* Handle `class << self`
+* Add `PG::Connection.escape_string` as a SQL sanitization method (Joévin Soulenq)
+
+# 6.0.1 - 2023-07-20
+
+* Accept strings for `load_defaults` version
+
 # 6.0.0 - 2023-05-24
 
 * Add obsolete fingerprints to comparison report

data/bundle/load.rb

@@ -1,15 +1,15 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/haml-5.2.2/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/highline-2.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/parallel-1.23.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/rexml-3.2.5/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/ruby2ruby-2.4.4/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/ruby_parser-3.20.1/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/safe_yaml-1.0.5/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/sexp_processor-4.17.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/slim-4.1.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/temple-0.8.2/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/tilt-2.0.11/lib"
-$:.unshift "#{path}/bundle/ruby/3.0.0/gems/unicode-display_width-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/erubis-2.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/haml-5.2.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/highline-2.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/parallel-1.23.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/rexml-3.2.6/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby2ruby-2.4.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-3.20.3/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/safe_yaml-1.0.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/sexp_processor-4.17.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/slim-4.1.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/temple-0.8.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/terminal-table-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/tilt-2.0.11/lib"
+$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-display_width-1.8.0/lib"

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/NEWS.md

@@ -1,15 +1,113 @@
 # News
 
+## 3.2.6 - 2023-07-27 {#version-3-2-6}
+
+### Improvements
+
+  * Required Ruby 2.5 or later explicitly.
+    [GH-69][gh-69]
+    [Patch by Ivo Anjo]
+
+  * Added documentation for maintenance cycle.
+    [GH-71][gh-71]
+    [Patch by Ivo Anjo]
+
+  * Added tutorial.
+    [GH-77][gh-77]
+    [GH-78][gh-78]
+    [Patch by Burdette Lamar]
+
+  * Improved performance and memory usage.
+    [GH-94][gh-94]
+    [Patch by fatkodima]
+
+  * `REXML::Parsers::XPathParser#abbreviate`: Added support for
+    function arguments.
+    [GH-95][gh-95]
+    [Reported by pulver]
+
+  * `REXML::Parsers::XPathParser#abbreviate`: Added support for string
+    literal that contains double-quote.
+    [GH-96][gh-96]
+    [Patch by pulver]
+
+  * `REXML::Parsers::XPathParser#abbreviate`: Added missing `/` to
+    `:descendant_or_self/:self/:parent`.
+    [GH-97][gh-97]
+    [Reported by pulver]
+
+  * `REXML::Parsers::XPathParser#abbreviate`: Added support for more patterns.
+    [GH-97][gh-97]
+    [Reported by pulver]
+
+### Fixes
+
+  * Fixed a typo in NEWS.
+    [GH-72][gh-72]
+    [Patch by Spencer Goodman]
+
+  * Fixed a typo in NEWS.
+    [GH-75][gh-75]
+    [Patch by Andrew Bromwich]
+
+  * Fixed documents.
+    [GH-87][gh-87]
+    [Patch by Alexander Ilyin]
+
+  * Fixed a bug that `Attriute` convert `'` and `'` even when
+    `attribute_quote: :quote` is used.
+    [GH-92][gh-92]
+    [Reported by Edouard Brière]
+
+  * Fixed links in tutorial.
+    [GH-99][gh-99]
+    [Patch by gemmaro]
+
+
+### Thanks
+
+  * Ivo Anjo
+
+  * Spencer Goodman
+
+  * Andrew Bromwich
+
+  * Burdette Lamar
+
+  * Alexander Ilyin
+
+  * Edouard Brière
+
+  * fatkodima
+
+  * pulver
+
+  * gemmaro
+
+[gh-69]:https://github.com/ruby/rexml/issues/69
+[gh-71]:https://github.com/ruby/rexml/issues/71
+[gh-72]:https://github.com/ruby/rexml/issues/72
+[gh-75]:https://github.com/ruby/rexml/issues/75
+[gh-77]:https://github.com/ruby/rexml/issues/77
+[gh-87]:https://github.com/ruby/rexml/issues/87
+[gh-92]:https://github.com/ruby/rexml/issues/92
+[gh-94]:https://github.com/ruby/rexml/issues/94
+[gh-95]:https://github.com/ruby/rexml/issues/95
+[gh-96]:https://github.com/ruby/rexml/issues/96
+[gh-97]:https://github.com/ruby/rexml/issues/97
+[gh-98]:https://github.com/ruby/rexml/issues/98
+[gh-99]:https://github.com/ruby/rexml/issues/99
+
 ## 3.2.5 - 2021-04-05 {#version-3-2-5}
 
 ### Improvements
 
   * Add more validations to XPath parser.
 
-  * `require "rexml/docuemnt"` by default.
+  * `require "rexml/document"` by default.
     [GitHub#36][Patch by Koichi ITO]
 
-  * Don't add `#dcloe` method to core classes globally.
+  * Don't add `#dclone` method to core classes globally.
     [GitHub#37][Patch by Akira Matsuda]
 
   * Add more documentations.

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/README.md

@@ -6,7 +6,7 @@ REXML supports both tree and stream document parsing. Stream parsing is faster (
 
 ## API
 
-See the {API documentation}[https://ruby.github.io/rexml/]
+See the [API documentation](https://ruby.github.io/rexml/).
 
 ## Usage
 
@@ -33,6 +33,15 @@ doc = Document.new string
 
 So parsing a string is just as easy as parsing a file.
 
+## Support
+
+REXML support follows the same maintenance cycle as Ruby releases, as shown on <https://www.ruby-lang.org/en/downloads/branches/>.
+
+If you are running on an end-of-life Ruby, do not expect modern REXML releases to be compatible with it; in fact, it's recommended that you DO NOT use this gem, and instead use the REXML version that came bundled with your end-of-life Ruby version.
+
+The `required_ruby_version` on the gemspec is kept updated on a [best-effort basis](https://github.com/ruby/rexml/pull/70) by the community.
+Up to version 3.2.5, this information was not set. That version [is known broken with at least Ruby < 2.3](https://github.com/ruby/rexml/issues/69).
+
 ## Development
 
 After checking out the repo, run `rake test` to run the tests.

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/lib/rexml/attribute.rb

@@ -1,4 +1,4 @@
-# frozen_string_literal: false
+# frozen_string_literal: true
 require_relative "namespace"
 require_relative 'text'
 
@@ -13,9 +13,6 @@ module REXML
 
     # The element to which this attribute belongs
     attr_reader :element
-    # The normalized value of this attribute.  That is, the attribute with
-    # entities intact.
-    attr_writer :normalized
     PATTERN = /\s*(#{NAME_STR})\s*=\s*(["'])(.*?)\2/um
 
     NEEDS_A_SECOND_CHECK = /(<|&((#{Entity::NAME});|(#0*((?:\d+)|(?:x[a-fA-F0-9]+)));)?)/um
@@ -122,10 +119,13 @@ module REXML
     #  b = Attribute.new( "ns:x", "y" )
     #  b.to_string     # -> "ns:x='y'"
     def to_string
+      value = to_s
       if @element and @element.context and @element.context[:attribute_quote] == :quote
-        %Q^#@expanded_name="#{to_s().gsub(/"/, '&quot;')}"^
+        value = value.gsub('"', '&quot;') if value.include?('"')
+        %Q^#@expanded_name="#{value}"^
       else
-        "#@expanded_name='#{to_s().gsub(/'/, '&apos;')}'"
+        value = value.gsub("'", '&apos;') if value.include?("'")
+        "#@expanded_name='#{value}'"
       end
     end
 
@@ -141,7 +141,6 @@ module REXML
       return @normalized if @normalized
 
       @normalized = Text::normalize( @unnormalized, doctype )
-      @unnormalized = nil
       @normalized
     end
 
@@ -150,10 +149,16 @@ module REXML
     def value
       return @unnormalized if @unnormalized
       @unnormalized = Text::unnormalize( @normalized, doctype )
-      @normalized = nil
       @unnormalized
     end
 
+    # The normalized value of this attribute.  That is, the attribute with
+    # entities intact.
+    def normalized=(new_normalized)
+      @normalized = new_normalized
+      @unnormalized = nil
+    end
+
     # Returns a copy of this attribute
     def clone
       Attribute.new self
@@ -190,7 +195,7 @@ module REXML
     end
 
     def inspect
-      rv = ""
+      rv = +""
       write( rv )
       rv
     end

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/lib/rexml/document.rb

@@ -69,7 +69,7 @@ module REXML
     #   d.to_s # => "<root><foo>Foo</foo><bar>Bar</bar></root>"
     #
     # When argument +document+ is given, it must be an existing
-    # document object, whose context and attributes (but not chidren)
+    # document object, whose context and attributes (but not children)
     # are cloned into the new document:
     #
     #   d = REXML::Document.new(xml_string)

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/lib/rexml/element.rb

@@ -989,7 +989,7 @@ module REXML
     # :call-seq:
     #   has_text? -> true or false
     #
-    # Returns +true if the element has one or more text noded,
+    # Returns +true+ if the element has one or more text noded,
     # +false+ otherwise:
     #
     #   d = REXML::Document.new '<a><b/>text<c/></a>'
@@ -1006,7 +1006,7 @@ module REXML
     #   text(xpath = nil) -> text_string or nil
     #
     # Returns the text string from the first text node child
-    # in a specified element, if it exists, # +nil+ otherwise.
+    # in a specified element, if it exists, +nil+ otherwise.
     #
     # With no argument, returns the text from the first text node in +self+:
     #
@@ -1014,7 +1014,7 @@ module REXML
     #   d.root.text.class # => String
     #   d.root.text       # => "some text "
     #
-    # With argument +xpath+, returns text from the the first text node
+    # With argument +xpath+, returns text from the first text node
     # in the element that matches +xpath+:
     #
     #   d.root.text(1) # => "this is bold!"

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/lib/rexml/entity.rb

@@ -132,24 +132,34 @@ module REXML
     # then:
     #  doctype.entity('yada').value   #-> "nanoo bar nanoo"
     def value
-      if @value
-        matches = @value.scan(PEREFERENCE_RE)
-        rv = @value.clone
-        if @parent
-          sum = 0
-          matches.each do |entity_reference|
-            entity_value = @parent.entity( entity_reference[0] )
-            if sum + entity_value.bytesize > Security.entity_expansion_text_limit
-              raise "entity expansion has grown too large"
-            else
-              sum += entity_value.bytesize
-            end
-            rv.gsub!( /%#{entity_reference.join};/um, entity_value )
+      @resolved_value ||= resolve_value
+    end
+
+    def parent=(other)
+      @resolved_value = nil
+      super
+    end
+
+    private
+    def resolve_value
+      return nil if @value.nil?
+      return @value unless @value.match?(PEREFERENCE_RE)
+
+      matches = @value.scan(PEREFERENCE_RE)
+      rv = @value.clone
+      if @parent
+        sum = 0
+        matches.each do |entity_reference|
+          entity_value = @parent.entity( entity_reference[0] )
+          if sum + entity_value.bytesize > Security.entity_expansion_text_limit
+            raise "entity expansion has grown too large"
+          else
+            sum += entity_value.bytesize
           end
+          rv.gsub!( /%#{entity_reference.join};/um, entity_value )
         end
-        return rv
       end
-      nil
+      rv
     end
   end
 

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/lib/rexml/formatters/pretty.rb

@@ -1,4 +1,4 @@
-# frozen_string_literal: false
+# frozen_string_literal: true
 require_relative 'default'
 
 module REXML
@@ -58,7 +58,7 @@ module REXML
           skip = false
           if compact
             if node.children.inject(true) {|s,c| s & c.kind_of?(Text)}
-              string = ""
+              string = +""
               old_level = @level
               @level = 0
               node.children.each { |child| write( child, string ) }

data/bundle/ruby/{3.0.0/gems/rexml-3.2.5 → 3.1.0/gems/rexml-3.2.6}/lib/rexml/namespace.rb

@@ -1,4 +1,4 @@
-# frozen_string_literal: false
+# frozen_string_literal: true
 
 require_relative 'xmltokens'
 
@@ -10,13 +10,17 @@ module REXML
     # The expanded name of the object, valid if name is set
     attr_accessor :prefix
     include XMLTokens
+    NAME_WITHOUT_NAMESPACE = /\A#{NCNAME_STR}\z/
     NAMESPLIT = /^(?:(#{NCNAME_STR}):)?(#{NCNAME_STR})/u
 
     # Sets the name and the expanded name
     def name=( name )
       @expanded_name = name
-      case name
-      when NAMESPLIT
+      if name.match?(NAME_WITHOUT_NAMESPACE)
+        @prefix = ""
+        @namespace = ""
+        @name = name
+      elsif name =~ NAMESPLIT
         if $1
           @prefix = $1
         else
@@ -24,7 +28,7 @@ module REXML
           @namespace = ""
         end
         @name = $2
-      when ""
+      elsif name == ""
         @prefix = nil
         @namespace = nil
         @name = nil