brakeman 6.2.2 → 7.1.2

data/bundle/ruby/3.2.0/gems/unicode-emoji-4.2.0/lib/unicode/emoji/lazy_constants.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Unicode
+  module Emoji
+    # The current list of codepoints with the "Emoji" property
+    # Same characters as \p{Emoji}
+    # (Emoji version of this gem might be more recent than Ruby's Emoji version)
+    EMOJI_CHAR                    = INDEX[:PROPERTIES].select{ |ord, props| props.include?(:E) }.keys.freeze
+
+    # The current list of codepoints with the "Emoji_Presentation" property
+    # Same characters as \p{Emoji Presentation} or \p{EPres}
+    # (Emoji version of this gem might be more recent than Ruby's Emoji version)
+    EMOJI_PRESENTATION            = INDEX[:PROPERTIES].select{ |ord, props| props.include?(:P) }.keys.freeze
+
+    # The current list of codepoints with the "Emoji" property that lack the "Emoji Presentation" property
+    TEXT_PRESENTATION             = INDEX[:PROPERTIES].select{ |ord, props| props.include?(:E) && !props.include?(:P) }.keys.freeze
+
+    # The current list of codepoints with the "Emoji_Component" property
+    # Same characters as \p{Emoji Component} or \p{EComp}
+    # (Emoji version of this gem might be more recent than Ruby's Emoji version)
+    EMOJI_COMPONENT               = INDEX[:PROPERTIES].select{ |ord, props| props.include?(:C) }.keys.freeze
+
+    # The current list of codepoints with the "Emoji_Modifier_Base" property
+    # Same characters as \p{Emoji Modifier Base} or \p{EBase}
+    # (Emoji version of this gem might be more recent than Ruby's Emoji version)
+    EMOJI_MODIFIER_BASES          = INDEX[:PROPERTIES].select{ |ord, props| props.include?(:B) }.keys.freeze
+
+    # The current list of codepoints with the "Emoji_Modifier" property
+    # Same characters as \p{Emoji Modifier} or \p{EMod}
+    # (Emoji version of this gem might be more recent than Ruby's Emoji version)
+    EMOJI_MODIFIERS               = INDEX[:PROPERTIES].select{ |ord, props| props.include?(:M) }.keys.freeze
+
+    # The current list of codepoints with the "Extended_Pictographic" property
+    # Same characters as \p{Extended Pictographic} or \p{ExtPict}
+    # (Emoji version of this gem might be more recent than Ruby's Emoji version)
+    EXTENDED_PICTOGRAPHIC         = INDEX[:PROPERTIES].select{ |ord, props| props.include?(:X) }.keys.freeze
+
+    # The current list of codepoints with the "Extended_Pictographic" property that don't have the "Emoji" property
+    EXTENDED_PICTOGRAPHIC_NO_EMOJI= INDEX[:PROPERTIES].select{ |ord, props| props.include?(:X) && !props.include?(:E) }.keys.freeze
+
+    # The list of characters that can be used as base for keycap sequences
+    EMOJI_KEYCAPS                 = INDEX[:KEYCAPS].freeze
+
+    # The list of valid regions
+    VALID_REGION_FLAGS            = INDEX[:FLAGS].freeze
+
+    # The list of valid subdivisions in regex character class syntax
+    VALID_SUBDIVISIONS            = INDEX[:SD].map{_1.sub(/(.)~(.)/, '[\1-\2]') }
+
+    # The list RGI tag sequence flags
+    RECOMMENDED_SUBDIVISION_FLAGS = INDEX[:TAGS].freeze
+
+    # The list of fully-qualified RGI Emoji ZWJ sequences
+    RECOMMENDED_ZWJ_SEQUENCES     = INDEX[:ZWJ].freeze
+  end
+end

data/bundle/ruby/3.2.0/gems/unicode-emoji-4.2.0/lib/unicode/emoji/list.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Unicode
+  module Emoji
+    # Contains an ordered and group list of all currently recommended Emoji (RGI/FQE)
+    LIST                          = INDEX[:LIST].freeze.each_value(&:freeze)
+
+    # Sometimes, categories change, we issue a warning in these cases
+    LIST_REMOVED_KEYS             = [
+      "Smileys & People",
+    ].freeze
+  end
+end

data/bundle/ruby/3.2.0/gems/unicode-emoji-4.2.0/lib/unicode/emoji.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+require_relative "emoji/constants"
+
+module Unicode
+  module Emoji
+    autoload :INDEX, File.expand_path('emoji/index', __dir__)
+
+    %w[
+      EMOJI_CHAR
+      EMOJI_PRESENTATION
+      TEXT_PRESENTATION
+      EMOJI_COMPONENT
+      EMOJI_MODIFIER_BASES
+      EMOJI_MODIFIERS
+      EXTENDED_PICTOGRAPHIC
+      EXTENDED_PICTOGRAPHIC_NO_EMOJI
+      EMOJI_KEYCAPS
+      VALID_REGION_FLAGS
+      VALID_SUBDIVISIONS
+      RECOMMENDED_SUBDIVISION_FLAGS
+      RECOMMENDED_ZWJ_SEQUENCES
+    ].each do |const_name|
+      autoload const_name, File.expand_path('emoji/lazy_constants', __dir__)
+    end
+
+    %w[
+      LIST
+      LIST_REMOVED_KEYS
+    ].each do |const_name|
+      autoload const_name, File.expand_path('emoji/list', __dir__)
+    end
+
+    generated_constants_dirpath = File.expand_path(
+      EMOJI_VERSION == RbConfig::CONFIG["UNICODE_EMOJI_VERSION"] ? "emoji/generated_native/" : "emoji/generated/",
+      __dir__
+    )
+
+    %w[
+      REGEX
+      REGEX_INCLUDE_TEXT
+      REGEX_INCLUDE_MQE
+      REGEX_INCLUDE_MQE_UQE
+      REGEX_VALID
+      REGEX_VALID_INCLUDE_TEXT
+      REGEX_WELL_FORMED
+      REGEX_WELL_FORMED_INCLUDE_TEXT
+      REGEX_POSSIBLE
+      REGEX_BASIC
+      REGEX_TEXT
+      REGEX_TEXT_PRESENTATION
+      REGEX_PROP_EMOJI
+      REGEX_PROP_MODIFIER
+      REGEX_PROP_MODIFIER_BASE
+      REGEX_PROP_COMPONENT
+      REGEX_PROP_PRESENTATION
+      REGEX_PICTO
+      REGEX_PICTO_NO_EMOJI
+      REGEX_EMOJI_KEYCAP
+    ].each do |const_name|
+      autoload const_name, File.join(generated_constants_dirpath, const_name.downcase)
+    end
+
+    # Return Emoji properties of character as an Array or nil
+    # See PROPERTY_NAMES constant for possible properties
+    # 
+    # Source: see https://www.unicode.org/Public/16.0.0/ucd/emoji/emoji-data.txt
+    def self.properties(char)
+      ord = get_codepoint_value(char)
+      props = INDEX[:PROPERTIES][ord]
+
+      if props
+        props.map{ |prop| PROPERTY_NAMES[prop] }
+      else
+        # nothing
+      end
+    end
+
+    # Returns ordered list of Emoji, categorized in a three-level deep Hash structure
+    def self.list(key = nil, sub_key = nil)
+      return LIST unless key || sub_key
+      if LIST_REMOVED_KEYS.include?(key)
+        $stderr.puts "Warning(unicode-emoji): The category of #{key} does not exist anymore"
+      end
+      LIST.dig(*[key, sub_key].compact)
+    end
+
+    def self.get_codepoint_value(char)
+      ord = nil
+
+      if char.valid_encoding?
+        ord = char.ord
+      elsif char.encoding.name == "UTF-8"
+        begin
+          ord = char.unpack("U*")[0]
+        rescue ArgumentError
+        end
+      end
+
+      if ord
+        ord
+      else
+        raise(ArgumentError, "Unicode::Emoji must be given a valid string")
+      end
+    end
+
+    class << self
+      private :get_codepoint_value
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/unicode-emoji-4.2.0/unicode-emoji.gemspec

@@ -0,0 +1,22 @@
+# -*- encoding: utf-8 -*-
+
+require File.dirname(__FILE__) + "/lib/unicode/emoji/constants"
+
+Gem::Specification.new do |gem|
+  gem.name          = "unicode-emoji"
+  gem.version       = Unicode::Emoji::VERSION
+  gem.summary       = "Emoji data and regex"
+  gem.description   = "[Emoji #{Unicode::Emoji::EMOJI_VERSION}] Provides Unicode Emoji data and regexes, incorporating the latest Unicode and Emoji standards. Includes a categorized list of recommended Emoji."
+  gem.authors       = ["Jan Lelis"]
+  gem.email         = ["hi@ruby.consulting"]
+  gem.homepage      = "https://github.com/janlelis/unicode-emoji"
+  gem.license       = "MIT"
+
+  gem.files         = Dir["{**/}{.*,*}"].select{ |path| File.file?(path) && path !~ /^pkg/ && path !~ /spec\/data\/[^.]/ }
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.require_paths = ["lib"]
+  gem.metadata      = { "rubygems_mfa_required" => "true" }
+
+  gem.required_ruby_version = ">= 2.5"
+end

data/lib/brakeman/app_tree.rb

@@ -22,6 +22,8 @@ module Brakeman
       init_options[:additional_libs_path] = options[:additional_libs_path]
       init_options[:engine_paths] = options[:engine_paths]
       init_options[:skip_vendor] = options[:skip_vendor]
+      init_options[:follow_symlinks] = options[:follow_symlinks]
+
       new(root, init_options)
     end
 
@@ -31,6 +33,7 @@ module Brakeman
     #   * "path1/" - Matches any path that contains "path1" in the project directory.
     #   * "/path1/ - Matches any path that is rooted at "path1" in the project directory.
     #
+    # TODO: This is wacky and I don't like it.
     def self.regex_for_paths(paths)
       path_regexes = paths.map do |f|
         # If path ends in a file separator then we assume it is a path rather
@@ -64,6 +67,7 @@ module Brakeman
       @absolute_engine_paths = @engine_paths.select { |path| path.start_with?(File::SEPARATOR) }
       @relative_engine_paths = @engine_paths - @absolute_engine_paths
       @skip_vendor = init_options[:skip_vendor]
+      @follow_symlinks = init_options[:follow_symlinks]
       @gemspec = nil
       @root_search_pattern = nil
     end
@@ -142,6 +146,17 @@ module Brakeman
       end
     end
 
+
+    # Call this to be able to marshall the AppTree
+    def marshallable
+      @initializer_paths = @initializer_paths.to_a
+      @controller_paths = @controller_paths.to_a
+      @template_paths = @template_paths.to_a
+      @lib_files = @file_paths.to_a
+
+      self
+    end
+
   private
 
     def find_helper_paths
@@ -157,32 +172,48 @@ module Brakeman
     end
 
     def find_paths(directory, extensions = ".rb")
-      select_files(glob_files(directory, "*", extensions).sort)
+      select_files(glob_files(directory, "*", extensions))
     end
 
     def glob_files(directory, name, extensions = ".rb")
-      root_directory = "#{root_search_pattern}#{directory}"
-      patterns = ["#{root_directory}/**/#{name}#{extensions}"]
-
-      Dir.glob("#{root_directory}/**/*", File::FNM_DOTMATCH).each do |path|
-        if File.symlink?(path) && File.directory?(path)
-          symlink_target = File.readlink(path)
-          if Pathname.new(symlink_target).relative?
-            symlink_target = File.join(File.dirname(path), symlink_target)
+      if @follow_symlinks
+        root_directory = "#{root_search_pattern}#{directory}"
+        patterns = ["#{root_directory}/**/#{name}#{extensions}"]
+
+        Dir.glob("#{root_directory}/**/*", File::FNM_DOTMATCH).each do |path|
+          if File.symlink?(path) && File.directory?(path)
+            symlink_target = File.readlink(path)
+            if Pathname.new(symlink_target).relative?
+              symlink_target = File.join(File.dirname(path), symlink_target)
+            end
+            patterns << "#{search_pattern(symlink_target)}/**/#{name}#{extensions}"
           end
-          patterns << "#{search_pattern(symlink_target)}/**/#{name}#{extensions}"
         end
-      end
 
-      files = patterns.flat_map { |pattern| Dir.glob(pattern) }
-      files.uniq
+        files = patterns.flat_map { |pattern| Dir.glob(pattern) }
+        files.uniq.lazy
+      else
+        if directory == '.'
+          pattern = File.join(top_directories_pattern, '**', "#{name}#{extensions}")
+        else
+          pattern = "#{root_search_pattern}#{directory}/**/#{name}#{extensions}"
+        end
+
+        Dir.glob(pattern).lazy
+      end
     end
 
     def select_files(paths)
       paths = select_only_files(paths)
       paths = reject_skipped_files(paths)
       paths = convert_to_file_paths(paths)
-      reject_global_excludes(paths)
+      paths = reject_global_excludes(paths)
+      paths = reject_directories(paths)
+      paths
+    end
+
+    def reject_directories(paths)
+      paths.reject { |path| File.directory?(path) }
     end
 
     def select_only_files(paths)
@@ -201,15 +232,14 @@ module Brakeman
       end
     end
 
-    EXCLUDED_PATHS = %w[
-      /generators/
+    EXCLUDED_PATHS = regex_for_paths %w[
+      generators/
       lib/tasks/
       lib/templates/
       db/
       spec/
       test/
       tmp/
-      log/
     ]
 
     def reject_global_excludes(paths)
@@ -219,9 +249,7 @@ module Brakeman
         if @skip_vendor and relative_path.include? 'vendor/' and !in_engine_paths?(path) and !in_add_libs_paths?(path)
           true
         else
-          EXCLUDED_PATHS.any? do |excluded|
-            relative_path.include? excluded
-          end
+          match_path EXCLUDED_PATHS, path
         end
       end
     end
@@ -235,18 +263,47 @@ module Brakeman
     end
 
     def match_path files, path
+      # TODO: Converting to Pathnames and Strings seems like a lot
+      # of converting that could perhaps all be handled in Brakeman::FilePath
+      # instead?
       absolute_path = Pathname.new(path)
+
       # relative root never has a leading separator. But, we use a leading
       # separator in a @skip_files entry to imply that a directory is
       # "absolute" with respect to the project directory.
-      project_relative_path = File.join(
-        File::SEPARATOR,
-        absolute_path.relative_path_from(@project_root_path).to_s
-      )
+      #
+      # Also directories need a trailing separator.
+      project_relative_path = if File.directory?(path)
+        File.join(
+          File::SEPARATOR,
+          absolute_path.relative_path_from(@project_root_path).to_s,
+          File::SEPARATOR
+        )
+      else
+        File.join(
+          File::SEPARATOR,
+          absolute_path.relative_path_from(@project_root_path).to_s
+        )
+      end
 
       files.match(project_relative_path)
     end
 
+    def top_directories_pattern
+      top_dirs = convert_to_file_paths(Dir.glob(File.join(root_search_pattern, '*/')))
+      top_dirs.reject! { |d| File.symlink?(d) or !File.directory?(d) }
+      top_dirs = reject_global_excludes(top_dirs)
+      top_dirs = reject_skipped_files(top_dirs)
+
+      if top_dirs.empty?
+        # Fall back to searching everything, otherwise the empty pattern
+        # will start searching from the global root
+        root_search_pattern
+      else
+        "{#{top_dirs.join(',')}}"
+      end
+    end
+
     def root_search_pattern
       return @root_search_pattern if @root_search_pattern
       @root_search_pattern = search_pattern(@root)

data/lib/brakeman/checks/base_check.rb

@@ -151,10 +151,13 @@ class Brakeman::BaseCheck < Brakeman::SexpProcessor
     method[-1] == "?"
   end
 
-  TEMP_FILE_PATH = s(:call, s(:call, s(:const, :Tempfile), :new), :path).freeze
+  TEMP_FILE_PATH = [
+    s(:call, s(:call, s(:const, :Tempfile), :new), :path).freeze,
+    s(:call, s(:call, s(:const, :Tempfile), :create), :path).freeze
+  ].freeze
 
   def temp_file_path? exp
-    exp == TEMP_FILE_PATH
+    TEMP_FILE_PATH.include? exp
   end
 
   #Report a warning

data/lib/brakeman/checks/check_deserialize.rb

@@ -76,10 +76,13 @@ class Brakeman::CheckDeserialize < Brakeman::BaseCheck
       confidence = :high
     elsif input = include_user_input?(arg)
       confidence = :medium
+    elsif target == :Marshal
+      confidence = :low
+      message = msg("Use of ", msg_code("#{target}.#{method}"), " may be dangerous")
     end
 
     if confidence
-      message = msg(msg_code("#{target}.#{method}"), " called with ", msg_input(input))
+      message ||= msg(msg_code("#{target}.#{method}"), " called with ", msg_input(input))
 
       warn :result => result,
         :warning_type => "Remote Code Execution",

data/lib/brakeman/checks/check_eol_rails.rb

@@ -25,5 +25,6 @@ class Brakeman::CheckEOLRails < Brakeman::EOLCheck
     ['7.0.0', '7.0.99'] => Date.new(2025, 4, 1),
     ['7.1.0', '7.1.99'] => Date.new(2025, 10, 1),
     ['7.2.0', '7.2.99'] => Date.new(2026, 8, 9),
+    ['8.0.0', '8.0.99'] => Date.new(2026, 10, 7),
   }
 end

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -25,5 +25,6 @@ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
     ['3.1.0', '3.1.99'] => Date.new(2025, 3, 31),
     ['3.2.0', '3.2.99'] => Date.new(2026, 3, 31),
     ['3.3.0', '3.3.99'] => Date.new(2027, 3, 31),
+    ['3.4.0', '3.4.99'] => Date.new(2028, 3, 31),
   }
 end

data/lib/brakeman/checks/check_evaluation.rb

@@ -22,14 +22,51 @@ class Brakeman::CheckEvaluation < Brakeman::BaseCheck
   def process_result result
     return unless original? result
 
-    if input = include_user_input?(result[:call].arglist)
-      warn :result => result,
-        :warning_type => "Dangerous Eval",
-        :warning_code => :code_eval,
-        :message => "User input in eval",
-        :user_input => input,
-        :confidence => :high,
-        :cwe_id => [913, 95]
+    first_arg = result[:call].first_arg
+
+    unless safe_value? first_arg
+      if input = include_user_input?(first_arg)
+        confidence = :high
+        message = msg(msg_input(input), " evaluated as code")
+      elsif string_evaluation? first_arg
+        confidence = :low
+        message = "Dynamic string evaluated as code"
+      elsif result[:call].method == :eval
+        confidence = :low
+        message = "Dynamic code evaluation"
+      end
+
+      if confidence
+        warn :result => result,
+          :warning_type => "Dangerous Eval",
+          :warning_code => :code_eval,
+          :message => message,
+          :user_input => input,
+          :confidence => confidence,
+          :cwe_id => [913, 95]
+      end
+    end
+  end
+
+  def string_evaluation? exp
+    string_interp? exp or
+      (call? exp and string? exp.target)
+  end
+
+  def safe_value? exp
+    return true unless sexp? exp
+
+    case exp.sexp_type
+    when :dstr
+      exp.all? { |e| safe_value? e}
+    when :evstr
+      safe_value? exp.value
+    when :str, :lit
+      true
+    when :call
+      always_safe_method? exp.method
+    else
+      false
     end
   end
 end

data/lib/brakeman/checks/check_model_attr_accessible.rb

@@ -33,6 +33,7 @@ class Brakeman::CheckModelAttrAccessible < Brakeman::BaseCheck
               :confidence => confidence,
               :code => Sexp.new(:lit, attribute),
               :cwe_id => [915]
+
             break # Prevent from matching single attr multiple times
           end
         end

data/lib/brakeman/checks/check_render.rb

@@ -101,6 +101,11 @@ class Brakeman::CheckRender < Brakeman::BaseCheck
   def renderable? exp
     return false unless call?(exp) and constant?(exp.target)
 
+    if exp.method == :with_content
+      exp = exp.target
+    end
+
+    return false unless constant?(exp.target)
     target_class_name = class_name(exp.target)
     known_renderable_class?(target_class_name) or tracker.find_method(:render_in, target_class_name)
   end

data/lib/brakeman/checks/check_sql.rb

@@ -188,14 +188,20 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
                       when :find_by_sql, :count_by_sql
                         check_by_sql_arguments call.first_arg
                       when :calculate
-                        check_find_arguments call.third_arg
+                        if call.num_args > 2
+                          unsafe_sql?(call.second_arg) or check_find_arguments(call.third_arg)
+                        elsif call.num_args > 1
+                          unsafe_sql?(call.second_arg)
+                        end
                       when :last, :first, :all
                         check_find_arguments call.first_arg
                       when :average, :count, :maximum, :minimum, :sum
-                        if call.length > 5
-                          unsafe_sql?(call.first_arg) or check_find_arguments(call.last_arg)
+                        if call.num_args > 1
+                          if version_between?("0.0.0", "4.9.9") # In Rails 5+ these do not accept multiple arguments
+                            check_find_arguments(call.first_arg) or check_find_arguments(call.second_arg)
+                          end
                         else
-                          check_find_arguments call.last_arg
+                          check_find_arguments call.first_arg
                         end
                       when :where, :rewhere, :having, :find_by, :find_by!, :find_or_create_by, :find_or_create_by!, :find_or_initialize_by,:not, :delete_by, :destroy_by
                         check_query_arguments call.arglist
@@ -315,6 +321,9 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
       check_hash_keys arg
     elsif node_type? arg, :lit, :str
       nil
+    elsif node_type? arg, :or
+      check_query_arguments(arg.lhs) or
+        check_query_arguments(arg.rhs)
     else
       #Hashes are safe...but we check above for hash, so...?
       unsafe_sql? arg, :ignore_hash

data/lib/brakeman/checks/check_weak_rsa_key.rb

@@ -87,7 +87,7 @@ class Brakeman::CheckWeakRSAKey < Brakeman::BaseCheck
 
     if string? padding_arg
       padding_arg = padding_arg.deep_clone(padding_arg.line)
-      padding_arg.value.downcase!
+      padding_arg.value = padding_arg.value.downcase
     end
 
     case padding_arg

data/lib/brakeman/commandline.rb

@@ -145,6 +145,11 @@ module Brakeman
           quit Brakeman::Errors_Found_Exit_Code
         end
 
+        if tracker.options[:ensure_no_obsolete_ignore_entries] && tracker.unused_fingerprints.any?
+          warn '[Error] Obsolete ignore entries were found, exiting with an error code.'
+          quit Brakeman::Obsolete_Ignore_Entries_Exit_Code
+        end
+
         if ensure_ignore_notes_failed
           quit Brakeman::Empty_Ignore_Note_Exit_Code
         end

data/lib/brakeman/file_parser.rb

@@ -13,8 +13,9 @@ module Brakeman
       if @use_prism
         begin
           require 'prism'
+          Brakeman.debug '[Notice] Using Prism parser'
         rescue LoadError => e
-          Brakeman.debug "Asked to use Prism, but failed to load: #{e}"
+          Brakeman.debug "[Notice] Asked to use Prism, but failed to load: #{e}"
           @use_prism = false
         end
       end

data/lib/brakeman/file_path.rb

@@ -68,6 +68,10 @@ module Brakeman
       self.absolute
     end
 
+    # Required for Pathname compatibility.
+    # Ruby 3.5+ requires Pathname#initialize to receive a String or an object with to_path method.
+    alias to_path to_str
+
     # Returns a string with the absolute path.
     def to_s
       self.to_str

data/lib/brakeman/messages.rb

@@ -86,7 +86,7 @@ class Brakeman::Messages::Message
   end
 
   def to_html
-    require 'cgi'
+    require 'cgi/escape'
 
     output = @parts.map(&:to_html).join
 

data/lib/brakeman/options.rb

@@ -71,6 +71,10 @@ module Brakeman::Options
           options[:ensure_ignore_notes] = true
         end
 
+        opts.on "--ensure-no-obsolete-ignore-entries", "Fail when an obsolete ignore entry is found" do
+          options[:ensure_no_obsolete_ignore_entries] = true
+        end
+
         opts.on "-3", "--rails3", "Force Rails 3 mode" do
           options[:rails3] = true
         end
@@ -161,14 +165,13 @@ module Brakeman::Options
 
         opts.on "--[no-]prism", "Use the Prism parser" do |use_prism|
           if use_prism
-            prism_version = '0.30'
+            min_prism_version = '1.0.0'
 
             begin
-              # Specifying minimum version here,
-              # since it can't be in the gem dependency list because it is optional
-              gem 'prism', "~>#{prism_version}"
+              gem 'prism', ">=#{min_prism_version}"
+              require 'prism'
             rescue Gem::MissingSpecVersionError, Gem::MissingSpecError, Gem::LoadError => e
-              $stderr.puts "Please install `prism` version #{prism_version} or newer:"
+              $stderr.puts "Please install `prism` version #{min_prism_version} or newer:"
               raise e
             end
           end
@@ -223,6 +226,14 @@ module Brakeman::Options
           options[:engine_paths].merge paths
         end
 
+        opts.on '--[no-]follow-symlinks', 'Follow symbolic links for directions' do |follow_symlinks|
+          options[:follow_symlinks] = follow_symlinks
+        end
+
+        opts.on '--gemfile GEMFILE', 'Specify Gemfile to scan' do |gemfile|
+          options[:gemfile] = gemfile
+        end
+
         opts.on "-E", "--enable Check1,Check2,etc", Array, "Enable the specified checks" do |checks|
           checks.map! do |check|
             if check.start_with? "Check"