brakeman 6.0.0 → 7.1.0

data/bundle/ruby/3.0.0/gems/rexml-3.2.5/lib/rexml/source.rb

@@ -1,298 +0,0 @@
-# coding: US-ASCII
-# frozen_string_literal: false
-require_relative 'encoding'
-
-module REXML
-  # Generates Source-s.  USE THIS CLASS.
-  class SourceFactory
-    # Generates a Source object
-    # @param arg Either a String, or an IO
-    # @return a Source, or nil if a bad argument was given
-    def SourceFactory::create_from(arg)
-      if arg.respond_to? :read and
-          arg.respond_to? :readline and
-          arg.respond_to? :nil? and
-          arg.respond_to? :eof?
-        IOSource.new(arg)
-      elsif arg.respond_to? :to_str
-        require 'stringio'
-        IOSource.new(StringIO.new(arg))
-      elsif arg.kind_of? Source
-        arg
-      else
-        raise "#{arg.class} is not a valid input stream.  It must walk \n"+
-          "like either a String, an IO, or a Source."
-      end
-    end
-  end
-
-  # A Source can be searched for patterns, and wraps buffers and other
-  # objects and provides consumption of text
-  class Source
-    include Encoding
-    # The current buffer (what we're going to read next)
-    attr_reader :buffer
-    # The line number of the last consumed text
-    attr_reader :line
-    attr_reader :encoding
-
-    # Constructor
-    # @param arg must be a String, and should be a valid XML document
-    # @param encoding if non-null, sets the encoding of the source to this
-    # value, overriding all encoding detection
-    def initialize(arg, encoding=nil)
-      @orig = @buffer = arg
-      if encoding
-        self.encoding = encoding
-      else
-        detect_encoding
-      end
-      @line = 0
-    end
-
-
-    # Inherited from Encoding
-    # Overridden to support optimized en/decoding
-    def encoding=(enc)
-      return unless super
-      encoding_updated
-    end
-
-    # Scans the source for a given pattern.  Note, that this is not your
-    # usual scan() method.  For one thing, the pattern argument has some
-    # requirements; for another, the source can be consumed.  You can easily
-    # confuse this method.  Originally, the patterns were easier
-    # to construct and this method more robust, because this method
-    # generated search regexps on the fly; however, this was
-    # computationally expensive and slowed down the entire REXML package
-    # considerably, since this is by far the most commonly called method.
-    # @param pattern must be a Regexp, and must be in the form of
-    # /^\s*(#{your pattern, with no groups})(.*)/.  The first group
-    # will be returned; the second group is used if the consume flag is
-    # set.
-    # @param consume if true, the pattern returned will be consumed, leaving
-    # everything after it in the Source.
-    # @return the pattern, if found, or nil if the Source is empty or the
-    # pattern is not found.
-    def scan(pattern, cons=false)
-      return nil if @buffer.nil?
-      rv = @buffer.scan(pattern)
-      @buffer = $' if cons and rv.size>0
-      rv
-    end
-
-    def read
-    end
-
-    def consume( pattern )
-      @buffer = $' if pattern.match( @buffer )
-    end
-
-    def match_to( char, pattern )
-      return pattern.match(@buffer)
-    end
-
-    def match_to_consume( char, pattern )
-      md = pattern.match(@buffer)
-      @buffer = $'
-      return md
-    end
-
-    def match(pattern, cons=false)
-      md = pattern.match(@buffer)
-      @buffer = $' if cons and md
-      return md
-    end
-
-    # @return true if the Source is exhausted
-    def empty?
-      @buffer == ""
-    end
-
-    def position
-      @orig.index( @buffer )
-    end
-
-    # @return the current line in the source
-    def current_line
-      lines = @orig.split
-      res = lines.grep @buffer[0..30]
-      res = res[-1] if res.kind_of? Array
-      lines.index( res ) if res
-    end
-
-    private
-    def detect_encoding
-      buffer_encoding = @buffer.encoding
-      detected_encoding = "UTF-8"
-      begin
-        @buffer.force_encoding("ASCII-8BIT")
-        if @buffer[0, 2] == "\xfe\xff"
-          @buffer[0, 2] = ""
-          detected_encoding = "UTF-16BE"
-        elsif @buffer[0, 2] == "\xff\xfe"
-          @buffer[0, 2] = ""
-          detected_encoding = "UTF-16LE"
-        elsif @buffer[0, 3] == "\xef\xbb\xbf"
-          @buffer[0, 3] = ""
-          detected_encoding = "UTF-8"
-        end
-      ensure
-        @buffer.force_encoding(buffer_encoding)
-      end
-      self.encoding = detected_encoding
-    end
-
-    def encoding_updated
-      if @encoding != 'UTF-8'
-        @buffer = decode(@buffer)
-        @to_utf = true
-      else
-        @to_utf = false
-        @buffer.force_encoding ::Encoding::UTF_8
-      end
-    end
-  end
-
-  # A Source that wraps an IO.  See the Source class for method
-  # documentation
-  class IOSource < Source
-    #attr_reader :block_size
-
-    # block_size has been deprecated
-    def initialize(arg, block_size=500, encoding=nil)
-      @er_source = @source = arg
-      @to_utf = false
-      @pending_buffer = nil
-
-      if encoding
-        super("", encoding)
-      else
-        super(@source.read(3) || "")
-      end
-
-      if !@to_utf and
-          @buffer.respond_to?(:force_encoding) and
-          @source.respond_to?(:external_encoding) and
-          @source.external_encoding != ::Encoding::UTF_8
-        @force_utf8 = true
-      else
-        @force_utf8 = false
-      end
-    end
-
-    def scan(pattern, cons=false)
-      rv = super
-      # You'll notice that this next section is very similar to the same
-      # section in match(), but just a liiittle different.  This is
-      # because it is a touch faster to do it this way with scan()
-      # than the way match() does it; enough faster to warrant duplicating
-      # some code
-      if rv.size == 0
-        until @buffer =~ pattern or @source.nil?
-          begin
-            @buffer << readline
-          rescue Iconv::IllegalSequence
-            raise
-          rescue
-            @source = nil
-          end
-        end
-        rv = super
-      end
-      rv.taint if RUBY_VERSION < '2.7'
-      rv
-    end
-
-    def read
-      begin
-        @buffer << readline
-      rescue Exception, NameError
-        @source = nil
-      end
-    end
-
-    def consume( pattern )
-      match( pattern, true )
-    end
-
-    def match( pattern, cons=false )
-      rv = pattern.match(@buffer)
-      @buffer = $' if cons and rv
-      while !rv and @source
-        begin
-          @buffer << readline
-          rv = pattern.match(@buffer)
-          @buffer = $' if cons and rv
-        rescue
-          @source = nil
-        end
-      end
-      rv.taint if RUBY_VERSION < '2.7'
-      rv
-    end
-
-    def empty?
-      super and ( @source.nil? || @source.eof? )
-    end
-
-    def position
-      @er_source.pos rescue 0
-    end
-
-    # @return the current line in the source
-    def current_line
-      begin
-        pos = @er_source.pos        # The byte position in the source
-        lineno = @er_source.lineno  # The XML < position in the source
-        @er_source.rewind
-        line = 0                    # The \r\n position in the source
-        begin
-          while @er_source.pos < pos
-            @er_source.readline
-            line += 1
-          end
-        rescue
-        end
-        @er_source.seek(pos)
-      rescue IOError
-        pos = -1
-        line = -1
-      end
-      [pos, lineno, line]
-    end
-
-    private
-    def readline
-      str = @source.readline(@line_break)
-      if @pending_buffer
-        if str.nil?
-          str = @pending_buffer
-        else
-          str = @pending_buffer + str
-        end
-        @pending_buffer = nil
-      end
-      return nil if str.nil?
-
-      if @to_utf
-        decode(str)
-      else
-        str.force_encoding(::Encoding::UTF_8) if @force_utf8
-        str
-      end
-    end
-
-    def encoding_updated
-      case @encoding
-      when "UTF-16BE", "UTF-16LE"
-        @source.binmode
-        @source.set_encoding(@encoding, @encoding)
-      end
-      @line_break = encode(">")
-      @pending_buffer, @buffer = @buffer, ""
-      @pending_buffer.force_encoding(@encoding)
-      super
-    end
-  end
-end

data/bundle/ruby/3.0.0/gems/safe_yaml-1.0.5/CHANGES.md

@@ -1,154 +0,0 @@
-1.0.5
------
-
-- fixed [#80](https://github.com/dtao/safe_yaml/issues/80): uninitialized constant DateTime
-
-1.0.2
------
-
-- added warning when using Psych + an older version of libyaml
-
-1.0.1
------
-
-- fixed handling for strings that look like (invalid) dates
-
-1.0.0
------
-
-- updated date parsing to use local timezone
-- **now requiring "safe_yaml/load" provides `SafeYAML.load` without clobbering `YAML`**
-- fixed handling of empty files
-- fixed some (edge case) integer parsing bugs
-- fixed some JRuby-specific issues
-
-0.9.7
------
-
-- made handling of document frontmatter more robust
-- added more descriptive message to the warning for omitting the :safe option
-
-0.9.6
------
-
-- fixed handling of files with trailing content (after closing `---`)
-
-0.9.5
------
-
-- fixed permissions AGAIN
-
-0.9.4
------
-
-- corrected handling of symbols
-
-0.9.3
------
-
-- fixed permissions :(
-
-0.9.2
------
-
-- fixed error w/ parsing "!" when whitelisting tags
-- fixed parsing of the number 0 (d'oh!)
-
-0.9.1
------
-
-- added Yecht support (JRuby)
-- more bug fixes
-
-0.9.0
------
-
-- added `whitelist!` method for easily whitelisting tags
-- added support for call-specific options
-- removed deprecated methods
-
-0.8.6
------
-
-- fixed bug in float matcher
-
-0.8.5
------
-
-- performance improvements
-- made less verbose by default
-- bug fixes
-
-0.8.4
------
-
-- enhancements to parsing of integers, floats, and dates
-- updated built-in whitelist
-- more bug fixes
-
-0.8.3
------
-
-- fixed exception on parsing empty document
-- fixed handling of octal & hexadecimal numbers
-
-0.8.2
------
-
-- bug fixes
-
-0.8.1
------
-
-- added `:raise_on_unknown_tag` option
-- renamed `reset_defaults!` to `restore_defaults!`
-
-0.8
----
-
-- added tag whitelisting
-- more API changes
-
-0.7
----
-
-- separated YAML engine support from Ruby version
-- added support for binary scalars
-- numerous bug fixes and enhancements
-
-0.6
----
-
-- several API changes
-- added `SafeYAML::OPTIONS` for specifying default behavior
-
-0.5
----
-
-Added support for dates
-
-0.4
----
-
-- efficiency improvements
-- made `YAML.load` use `YAML.safe_load` by default
-- made symbol deserialization optional
-
-0.3
----
-
-Added Syck support
-
-0.2
----
-
-Added support for:
-
-- anchors & aliases
-- booleans
-- nils
-
-0.1
----
-
-Initial release

data/bundle/ruby/3.0.0/gems/safe_yaml-1.0.5/Gemfile

@@ -1,11 +0,0 @@
-source "https://rubygems.org"
-
-gemspec
-
-group :development do
-  gem "hashie"
-  gem "heredoc_unindent"
-  gem "rake"
-  gem "rspec"
-  gem "travis-lint"
-end

data/bundle/ruby/3.0.0/gems/safe_yaml-1.0.5/README.md

@@ -1,191 +0,0 @@
-SafeYAML
-========
-
-[![Build Status](https://travis-ci.org/dtao/safe_yaml.png)](http://travis-ci.org/dtao/safe_yaml)
-[![Gem Version](https://badge.fury.io/rb/safe_yaml.png)](http://badge.fury.io/rb/safe_yaml)
-
-The **SafeYAML** gem provides an alternative implementation of `YAML.load` suitable for accepting user input in Ruby applications. Unlike Ruby's built-in implementation of `YAML.load`, SafeYAML's version will not expose apps to arbitrary code execution exploits (such as [the ones discovered](http://www.reddit.com/r/netsec/comments/167c11/serious_vulnerability_in_ruby_on_rails_allowing/) [in Rails in early 2013](http://www.h-online.com/open/news/item/Rails-developers-close-another-extremely-critical-flaw-1793511.html)).
-
-**If you encounter any issues with SafeYAML, check out the 'Common Issues' section below.** If you don't see anything that addresses the problem you're experiencing, by all means, [create an issue](https://github.com/dtao/safe_yaml/issues/new)!
-
-Installation
-------------
-
-Add this line to your application's Gemfile:
-
-```ruby
-gem "safe_yaml"
-```
-
-Configuration
--------------
-
-If *all you do* is add SafeYAML to your project, then `YAML.load` will operate in "safe" mode, which means it won't deserialize arbitrary objects. However, it will issue a warning the first time you call it because you haven't explicitly specified whether you want safe or unsafe behavior by default. To specify this behavior (e.g., in a Rails initializer):
-
-```ruby
-SafeYAML::OPTIONS[:default_mode] = :safe # or :unsafe
-```
-
-Another important option you might want to specify on startup is whether or not to allow *symbols* to be deserialized. The default setting is `false`, since symbols are not garbage collected in Ruby and so deserializing them from YAML may render your application vulnerable to a DOS (denial of service) attack. To allow symbol deserialization by default:
-
-```ruby
-SafeYAML::OPTIONS[:deserialize_symbols] = true
-```
-
-For more information on these and other options, see the "Usage" section down below.
-
-What is this gem for, exactly?
-------------------------------
-
-Suppose your application were to use a popular open source library which contained code like this:
-
-```ruby
-class ClassBuilder
-  def []=(key, value)
-    @class ||= Class.new
-
-    @class.class_eval <<-EOS
-      def #{key}
-        #{value}
-      end
-    EOS
-  end
-
-  def create
-    @class.new
-  end
-end
-```
-
-Now, if you were to use `YAML.load` on user input anywhere in your application without the SafeYAML gem installed, an attacker who suspected you were using this library could send a request with a carefully-crafted YAML string to execute arbitrary code (yes, including `system("unix command")`) on your servers.
-
-This simple example demonstrates the vulnerability:
-
-```ruby
-yaml = <<-EOYAML
---- !ruby/hash:ClassBuilder
-"foo; end; puts %(I'm in yr system!); def bar": "baz"
-EOYAML
-```
-
-    > YAML.load(yaml)
-    I'm in yr system!
-    => #<ClassBuilder:0x007fdbbe2e25d8 @class=#<Class:0x007fdbbe2e2510>>
-
-With SafeYAML, the same attacker would be thwarted:
-
-    > require "safe_yaml"
-    => true
-    > YAML.load(yaml, :safe => true)
-    => {"foo; end; puts %(I'm in yr system!); def bar"=>"baz"}
-
-Usage
------
-
-When you require the safe_yaml gem in your project, `YAML.load` is patched to accept one additional (optional) `options` parameter. This changes the method signature as follows:
-
-- for Syck and Psych prior to Ruby 1.9.3: `YAML.load(yaml, options={})`
-- for Psych in 1.9.3 and later: `YAML.load(yaml, filename=nil, options={})`
-
-The most important option is the `:safe` option (default: `true`), which controls whether or not to deserialize arbitrary objects when parsing a YAML document. The other options, along with explanations, are as follows.
-
-- `:deserialize_symbols` (default: `false`): Controls whether or not YAML will deserialize symbols. It is probably best to only enable this option where necessary, e.g. to make trusted libraries work. Symbols receive special treatment in Ruby and are not garbage collected, which means deserializing them indiscriminately may render your site vulnerable to a DOS attack.
-
-- `:whitelisted_tags`: Accepts an array of YAML tags that designate trusted types, e.g., ones that can be deserialized without worrying about any resulting security vulnerabilities. When any of the given tags are encountered in a YAML document, the associated data will be parsed by the underlying YAML engine (Syck or Psych) for the version of Ruby you are using. See the "Whitelisting Trusted Types" section below for more information.
-
-- `:custom_initializers`: Similar to the `:whitelisted_tags` option, but allows you to provide your own initializers for specified tags rather than using Syck or Psyck. Accepts a hash with string tags for keys and lambdas for values.
-
-- `:raise_on_unknown_tag` (default: `false`): Represents the highest possible level of paranoia. If the YAML engine encounters any tag other than ones that are automatically trusted by SafeYAML or that you've explicitly whitelisted, it will raise an exception. This may be a good choice if you expect to always be dealing with perfectly safe YAML and want your application to fail loudly upon encountering questionable data.
-
-All of the above options can be set at the global level via `SafeYAML::OPTIONS`. You can also set each one individually per call to `YAML.load`; an option explicitly passed to `load` will take precedence over an option specified globally.
-
-What if I don't *want* to patch `YAML`?
----------------------------------------
-
-[Excellent question](https://github.com/dtao/safe_yaml/issues/47)! You can also get the methods `SafeYAML.load` and `SafeYAML.load_file` without touching the `YAML` module at all like this:
-
-```ruby
-require "safe_yaml/load" # instead of require "safe_yaml"
-```
-
-This way, you can use `SafeYAML.load` to parse YAML that *you* don't trust, without affecting the rest of an application (if you're developing a library, for example).
-
-Supported Types
----------------
-
-The way that SafeYAML works is by restricting the kinds of objects that can be deserialized via `YAML.load`. More specifically, only the following types of objects can be deserialized by default:
-
-- Hashes
-- Arrays
-- Strings
-- Numbers
-- Dates
-- Times
-- Booleans
-- Nils
-
-Again, deserialization of symbols can be enabled globally by setting `SafeYAML::OPTIONS[:deserialize_symbols] = true`, or in a specific call to `YAML.load([some yaml], :deserialize_symbols => true)`.
-
-Whitelisting Trusted Types
---------------------------
-
-SafeYAML supports whitelisting certain YAML tags for trusted types. This is handy when your application uses YAML to serialize and deserialize certain types not listed above, which you know to be free of any deserialization-related vulnerabilities.
-
-The easiest way to whitelist types is by calling `SafeYAML.whitelist!`, which can accept a variable number of safe types, e.g.:
-
-```ruby
-SafeYAML.whitelist!(Foo, Bar)
-```
-
-You can also whitelist YAML *tags* via the `:whitelisted_tags` option:
-
-```ruby
-# Using Syck
-SafeYAML::OPTIONS[:whitelisted_tags] = ["tag:ruby.yaml.org,2002:object:OpenStruct"]
-
-# Using Psych
-SafeYAML::OPTIONS[:whitelisted_tags] = ["!ruby/object:OpenStruct"]
-```
-
-And in case you were wondering: no, this feature will *not* allow would-be attackers to embed untrusted types within trusted types:
-
-```ruby
-yaml = <<-EOYAML
---- !ruby/object:OpenStruct 
-table: 
-  :backdoor: !ruby/hash:ClassBuilder 
-    "foo; end; puts %(I'm in yr system!); def bar": "baz"
-EOYAML
-```
-
-    > YAML.safe_load(yaml)
-    => #<OpenStruct :backdoor={"foo; end; puts %(I'm in yr system!); def bar"=>"baz"}>
-
-Known Issues
-------------
-
-If you add SafeYAML to your project and start seeing any errors about missing keys, or you notice mysterious strings that look like `":foo"` (i.e., start with a colon), it's likely you're seeing errors from symbols being saved in YAML format. If you are able to modify the offending code, you might want to consider changing your YAML content to use plain vanilla strings instead of symbols. If not, you may need to set the `:deserialize_symbols` option to `true`, either in calls to `YAML.load` or---as a last resort---globally, with `SafeYAML::OPTIONS[:deserialize_symbols]`.
-
-Also be aware that some Ruby libraries, particularly those requiring inter-process communication, leverage YAML's object deserialization functionality and therefore may break or otherwise be impacted by SafeYAML. The following list includes known instances of SafeYAML's interaction with other Ruby gems:
-
-- [**ActiveRecord**](https://github.com/rails/rails/tree/master/activerecord): uses YAML to control serialization of model objects using the `serialize` class method. If you find that accessing serialized properties on your ActiveRecord models is causing errors, chances are you may need to:
-  1. set the `:deserialize_symbols` option to `true`,
-  2. whitelist some of the types in your serialized data via `SafeYAML.whitelist!` or the `:whitelisted_tags` option, or
-  3. both
-- [**delayed_job**](https://github.com/collectiveidea/delayed_job): Uses YAML to serialize the objects on which delayed methods are invoked (with `delay`). The safest solution in this case is to use `SafeYAML.whitelist!` to whitelist the types you need to serialize.
-- [**Guard**](https://github.com/guard/guard): Uses YAML as a serialization format for notifications. The data serialized uses symbolic keys, so setting `SafeYAML::OPTIONS[:deserialize_symbols] = true` is necessary to allow Guard to work.
-- [**sidekiq**](https://github.com/mperham/sidekiq): Uses a YAML configiuration file with symbolic keys, so setting `SafeYAML::OPTIONS[:deserialize_symbols] = true` should allow it to work.
-
-The above list will grow over time, as more issues are discovered.
-
-Versioning
-----------
-
-SafeYAML will follow [semantic versioning](http://semver.org/) so any updates to the first major version will maintain backwards compatability. So expect primarily bug fixes and feature enhancements (if anything!) from here on out... unless it makes sense to break the interface at some point and introduce a version 2.0, which I honestly think is unlikely.
-
-Requirements
-------------
-
-SafeYAML requires Ruby 1.8.7 or newer and works with both [Syck](http://www.ruby-doc.org/stdlib-1.8.7/libdoc/yaml/rdoc/YAML.html) and [Psych](http://github.com/tenderlove/psych).
-
-If you are using a version of Ruby where Psych is the default YAML engine (e.g., 1.9.3) but you want to use Syck, be sure to set `YAML::ENGINE.yamler = "syck"` **before** requiring the safe_yaml gem.

data/bundle/ruby/3.0.0/gems/safe_yaml-1.0.5/bundle_install_all_ruby_versions.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-[[ -s "$HOME/.rvm/scripts/rvm" ]] && . "$HOME/.rvm/scripts/rvm"
-
-declare -a versions=("1.8.7" "1.9.2" "1.9.3" "2.0.0" "2.1.0" "2.1.1" "2.1.2" "ruby-head" "jruby")
-
-for i in "${versions[@]}"
-do
-  rvm use $i
-  bundle install
-done

data/bundle/ruby/3.0.0/gems/safe_yaml-1.0.5/lib/safe_yaml/deep.rb

@@ -1,34 +0,0 @@
-module SafeYAML
-  class Deep
-    def self.freeze(object)
-      object.each do |*entry|
-        value = entry.last
-        case value
-        when String, Regexp
-          value.freeze
-        when Enumerable
-          Deep.freeze(value)
-        end
-      end
-
-      return object.freeze
-    end
-
-    def self.copy(object)
-      duplicate = object.dup rescue object
-
-      case object
-      when Array
-        (0...duplicate.count).each do |i|
-          duplicate[i] = Deep.copy(duplicate[i])
-        end
-      when Hash
-        duplicate.keys.each do |key|
-          duplicate[key] = Deep.copy(duplicate[key])
-        end
-      end
-
-      duplicate
-    end
-  end
-end