brakeman 6.2.2 → 8.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cf4fe6bd864ca4c38eeafab29e0e92c025dca7054dbe9caf887029fad46b8a37
-  data.tar.gz: ef08764d443287b902752facc0658f79c6d977cd2351820f5ef1953e578992ff
+  metadata.gz: e45a11303dbd8c6902dba215a487cdca4252af7a9f7c02a7d31e9ca571809747
+  data.tar.gz: 6fc0d4a0ab89636e77bcee75e90d8de1ed473b231f0d9a6e7a7bf37cb988c905
 SHA512:
-  metadata.gz: 3dfce43134e8995513b9e5bc97459d8a2cc26ee50ceddcb500fbdffb9597eedbed6fd2e01bccbdeb14df81f6973604d01ef84e3ab02e556394498e01a09e0b8e
-  data.tar.gz: 4cccdf4a2d959dfefb7bfb7bf39a53599fb3cc425672e52a83417170cb618dbfae17c89e09676680c907cc8e1fd912cafa82025184af506a1c51fe183c3c9f72
+  metadata.gz: a7c2b6622fccee070a679d47918f3a907b7b4fed0937b74bcb4276bd5bf2abe87e47934e16b10e9c0c8e847c558c7ec924871b867655b3aac58d6c793bc0d2fe
+  data.tar.gz: 03c2dc430960aa0dc0c5958acd7fefe0732596b86f5133ac21e509399f2ba3e370a2a3f5b407a3d69caac7ac7875298029e6831ee0ef4ce51d22fc95ea5f26ec

data/CHANGES.md

@@ -1,3 +1,113 @@
+# 8.0.6 - 2026-08-13
+
+* Fix EOL date for Rails 8.0 (yeaseul-kim)
+* Add EOL dates for Rails 8.1 and Ruby 4.0
+* Fix command injection false positives (Jacob Evelyn)
+* Fix unused variable warning (viralpraxis)
+
+# 8.0.5 - 2026-06-12
+
+* Add `quote_schema_name` to safe quote method list (Zsolt Kozaroczy)
+* Fix SQL injection false positive for `compact_blank`/`compact` on permitted params (Arpit Jain)
+* Fix inline render false positive for local named `text` (Arpit Jain)
+* Fix HAML crash on `.raw` calls (Federico Franco)
+* Fix Ruby version parsing - especially for non-CRuby versions (Chris Southerland Jr) 
+* Fix `TemplateAliasProcessor#template_name` arity (viralpraxis)
+* Reduce false positives when using shell escaping
+
+# 8.0.4 - 2026-02-26
+
+* Load 'date' library for `--ensure-latest`
+
+# 8.0.3 - 2026-02-26
+
+* Fix `polymorphic_name` SQLi false positive (Fredrico Franco)
+* Fix logger behavior when loading config files
+* Handle application names with module prefixes
+* Add release age option for `--ensure-latest`
+
+# 8.0.2 - 2026-02-03
+
+* Reline console control should use stderr
+* Fix logger cleanup based method (Imran Iqbal)
+
+# 8.0.1 - 2026-01-29
+
+* Make sure to reset the cursor even when exit code is 0
+
+# 8.0.0 - 2026-01-29
+
+* No longer produce weak dynamic render path warnings
+* `--skip-libs` removed
+* `--index-libs` removed
+* Revamp of scan progress output and logging
+* Faster file globbing for templates (Mikael Henriksson)
+* Fix singleton method prefixes (viralpraxis)
+* Fix qualified constant lookup to respect module/class context (Mike Dalessio)
+* Replace Erubis with Erubi
+
+# 7.1.2 - 2025-12-25
+
+* Update `ruby_parser` to remove version restriction (Chedli Bourguiba)
+* Raise minimum required Ruby to 3.2.0
+* Use Minitest 6.0
+* Reduce SQL injection false positives from `count` calls
+* Ignore more Haml attribute builder methods
+
+# 7.1.1 - 2025-11-03
+
+* Fix false positive when calling `with_content` on ViewComponents (Peer Allan)
+* Word wrap text output in pager
+* Consider Tempfile.create.path as safe input (Ali Ismayilov)
+* Exclude directories before searching for files
+* Check each side of `or` SQL arguments
+* Ignore attribute builder in Haml 6
+* Add `FilePath#to_path` for Ruby 3.5 compatibility (S-H-GAMELINKS)
+* Fix SQL injection check for calculate method (Rohan Sharma)
+* Fix missing `td` in HTML report (John Hawthorn)
+* Check for unsafe SQL when two arguments are passed to AR methods (Patrick Brinich-Langlois)
+
+# 7.1.0 - 2025-07-18
+
+* Add EOL dates for Rails 8.0 and Ruby 3.4
+* Support render model shortcut
+* Use lazy file lists for AppTree
+* Add Haml 6.x support
+* Improve ignored warnings layout in HTML report (Sebastien Savater)
+* Update JUnit report for CircleCI (Philippe Bernery)
+* Only load escape functionality from cgi library (Earlopain)
+* Add `--ensure-no-obsolete-ignore-entries` option (viralpraxis)
+
+# 7.0.2 - 2025-04-04
+
+* Fix error with empty `BUNDLE_GEMFILE` env variable
+
+# 7.0.1 - 2025-04-03
+
+* Avoid warning on evaluation of plain strings
+* Enable use of custom/alternative Gemfiles
+* Fix error on directory with `rb` extension (viralpraxis)
+* Support `terminal-table` 4.0 (Chedli Bourguiba)
+* Better support Prism 1.4.0
+* Only output timing for each file when using `--debug`
+
+# 7.0.0 - 2024-12-30
+
+* Always warn about deserializing from Marshal
+* Output `originalBaseUriIds` for SARIF format report
+* Default to using Prism parser if available (disable with `--no-prism`)
+* Update `terminal-table` version to use latest
+* Update `eval` check to be a little noisier
+* Fix array/hash unknown index handling
+* Disable following symbolic links by default, re-enable with --follow-symlinks
+* Add step (and timing) for finding files
+* Add CSV library as explicit dependency for Ruby 3.4 support
+* Major changes to how rescanning works
+* Raise minimum Ruby version to 3.1
+* Fix hardcoded globally excluded paths
+* Remove updated entry in Brakeman ignore files (Toby Hsieh)
+* Fix recursion when handling multiple assignment expressions
+
 # 6.2.2 - 2024-10-15
 
 * Ignore more native gems when building gem

data/README.md

@@ -1,7 +1,7 @@
 [![Brakeman Logo](http://brakemanscanner.org/images/logo_medium.png)](http://brakemanscanner.org/)
 
 [![Build Status](https://circleci.com/gh/presidentbeef/brakeman.svg?style=svg)](https://circleci.com/gh/presidentbeef/brakeman)
-[![Test Coverage](https://api.codeclimate.com/v1/badges/1b08a5c74695cb0d11ec/test_coverage)](https://codeclimate.com/github/presidentbeef/brakeman/test_coverage)
+[![Code Coverage](https://qlty.sh/gh/presidentbeef/projects/brakeman/coverage.svg)](https://qlty.sh/gh/presidentbeef/projects/brakeman)
 
 # Brakeman
 
@@ -63,9 +63,9 @@ Outside of Rails root (note that the output file is relative to path/to/rails/ap
 
 # Compatibility
 
-Brakeman should work with any version of Rails from 2.3.x to 7.x.
+Brakeman should work with any version of Rails from 2.3.x to 8.x.
 
-Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.0.0 to run.
+Brakeman can analyze code written with Ruby 2.0 syntax and newer, but requires at least Ruby 3.2.0 to run.
 
 # Basic Options
 
@@ -75,7 +75,7 @@ To specify an output file for the results:
 
     brakeman -o output_file
 
-The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `tabs`, `json`, `junit`, `markdown`, `csv`, `codeclimate`, and `sonar`.
+The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `tabs`, `json`, `junit`, `markdown`, `csv`, `codeclimate`, `github`, `sarif`, and `sonar`.
 
 Multiple output files can be specified:
 

data/bundle/load.rb

@@ -1,15 +1,17 @@
 path = File.expand_path('../..', __FILE__)
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/erubis-2.7.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/haml-5.2.2/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/highline-3.1.1/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/parallel-1.26.3/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/reline-0.5.10/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/rexml-3.3.8/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby2ruby-2.5.1/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/ruby_parser-3.20.3/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/sexp_processor-4.17.2/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/slim-5.2.1/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/temple-0.10.3/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/terminal-table-1.8.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/tilt-2.4.0/lib"
-$:.unshift "#{path}/bundle/ruby/3.1.0/gems/unicode-display_width-1.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/csv-3.3.6/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/haml-6.4.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/highline-3.1.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/parallel-1.28.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/reline-0.7.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/rexml-3.4.4/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/ruby2ruby-2.5.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/ruby_parser-3.22.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/sexp_processor-4.17.5/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/slim-5.2.2/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/temple-0.10.6/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/terminal-table-4.0.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/tilt-2.8.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/unicode-display_width-3.2.0/lib"
+$:.unshift "#{path}/bundle/ruby/3.2.0/gems/unicode-emoji-4.2.0/lib"

data/bundle/ruby/3.2.0/gems/csv-3.3.6/LICENSE.txt

@@ -0,0 +1,33 @@
+Copyright (C) 2005-2016 James Edward Gray II. All rights reserved.
+Copyright (C) 2007-2017 Yukihiro Matsumoto. All rights reserved.
+Copyright (C) 2017 SHIBATA Hiroshi. All rights reserved.
+Copyright (C) 2017 Olivier Lacan. All rights reserved.
+Copyright (C) 2017 Espartaco Palma. All rights reserved.
+Copyright (C) 2017 Marcus Stollsteimer. All rights reserved.
+Copyright (C) 2017 pavel. All rights reserved.
+Copyright (C) 2017-2018 Steven Daniels. All rights reserved.
+Copyright (C) 2018 Tomohiro Ogoke. All rights reserved.
+Copyright (C) 2018 Kouhei Sutou. All rights reserved.
+Copyright (C) 2018 Mitsutaka Mimura. All rights reserved.
+Copyright (C) 2018 Vladislav. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.