brakeman 6.2.2 → 8.0.6

data/lib/brakeman/logger.rb

@@ -0,0 +1,265 @@
+module Brakeman
+  module Logger
+    def self.get_logger options, dest = $stderr
+      case
+      when options[:debug]
+        Debug.new(options, dest)
+      when options[:quiet]
+        Quiet.new(options, dest)
+      when options[:report_progress] == false
+        Plain.new(options, dest)
+      when dest.tty?
+        Console.new(options, dest)
+      else
+        Plain.new(options, dest)
+      end
+    end
+
+    class Base
+      def initialize(options, log_destination = $stderr)
+        @dest = log_destination
+        @show_timing = options[:debug] || options[:show_timing]
+      end
+
+      # Output a message to the log.
+      # If newline is `false`, does not output a newline after message.
+      def log(message, newline: true)
+        if newline
+          @dest.puts message
+        else
+          @dest.write message
+        end
+      end
+
+      # Notify about important information - use sparingly
+      def announce(message); end
+
+      # Notify regarding errors - use sparingly
+      def alert(message); end
+
+      # Output debug information
+      def debug(message); end
+
+      # Wraps a step in the scanning process
+      def context(description, &)
+        yield self
+      end
+
+      # Wraps a substep (e.g. processing one file)
+      def single_context(description, &)
+        yield
+      end
+
+      # Update progress towards a known total
+      def update_progress(current, total, type = 'files'); end
+
+      # Show a spinner
+      def spin; end
+
+      # Called on exit
+      def cleanup(newline = true); end
+
+      def show_timing? = @show_timing
+
+      # Use ANSI codes to color a string
+      def color(message, *)
+        if @highline
+          @highline.color(message, *)
+        else
+          message
+        end
+      end
+
+      def color?
+        @highline and @highline.use_color?
+      end
+
+      private
+
+      def load_highline(output_color)
+        if @dest.tty? or output_color == :force
+          Brakeman.load_brakeman_dependency 'highline'
+          @highline = HighLine.new
+          @highline.use_color = !!output_color
+        else
+          @highline = nil
+        end
+      end
+    end
+
+    class Plain < Base
+      def initialize(options, *)
+        super
+
+        load_highline(options[:output_color])
+      end
+
+      def announce(message)
+        log color(message, :bold, :green)
+      end
+
+      def alert(message)
+        log color(message, :red)
+      end
+
+      def context(description, &)
+        log "#{color(description, :green)}..."
+
+        if show_timing?
+          time_step(description, &)
+        else
+          yield
+        end
+      end
+
+      def time_step(description, &)
+        start_t = Time.now
+        yield
+        duration = Time.now - start_t
+
+        log color(("Completed #{description.to_s.downcase} in %0.2fs" % duration), :gray)
+      end
+    end
+
+    class Quiet < Base
+      def initialize(*)
+        super
+      end
+    end
+
+    class Debug < Plain
+      def debug(message)
+        log color(message, :gray)
+      end
+
+      def context(description, &)
+        log "#{description}..."
+
+        time_step(description, &)
+      end
+
+      def single_context(description, &)
+        debug "Processing #{description}"
+
+        if show_timing?
+          # Even in debug, only show timing for each file if asked
+          time_step(description, &)
+        else
+          yield
+        end
+      end
+    end
+
+    class Console < Base
+      attr_reader :prefix
+
+      def initialize(options, *)
+        super
+
+        load_highline(options[:output_color])
+        require 'reline'
+        require 'reline/io/ansi'
+
+        @prefix = ''
+        @post_fix_pos = 0
+        @reline = Reline::ANSI.new
+        @reline.output = @dest
+        @report_progress = options[:report_progress]
+        @spinner = ["⣀", "⣄", "⣤", "⣦", "⣶", "⣷", "⣿"]
+        @percenter = ["⣀", "⣤", "⣶", "⣿"]
+        @spindex = 0
+        @last_spin = Time.now
+        @reline.hide_cursor
+      end
+
+      def announce message
+        clear_line
+        log color(message, :bold, :green)
+        rewrite_prefix
+      end
+
+      def alert message
+        clear_line
+        log color(message, :red)
+        rewrite_prefix
+      end
+
+      def context(description, &)
+        write_prefix description
+
+        time_step(description, &)
+      ensure
+        clear_prefix
+      end
+
+      def time_step(description, &)
+        if show_timing?
+          start_t = Time.now
+          yield
+          duration = Time.now - start_t
+
+          write_after color(('%0.2fs' % duration), :gray)
+          log ''
+        else
+          yield
+        end
+      end
+
+      def update_progress current, total, type = 'files'
+        percent = ((current / total.to_f) * 100).to_i
+        tenths = [(percent / 10), 0].max
+
+        lead = color(@percenter[percent % 10 / 3], :bold, :red)
+        done_blocks = color("⣿" * tenths, :red)
+        remaining = color("⣀" * (9 - tenths), :gray)
+        write_after "#{done_blocks}#{lead}#{remaining}"
+      end
+
+      def write_prefix pref
+        set_prefix pref
+        rewrite_prefix
+      end
+
+      # If an alert was written, redo prefix on next line
+      def rewrite_prefix
+        log(@prefix, newline: false)
+        @reline.erase_after_cursor
+      end
+
+      def write_after message
+        @reline.move_cursor_column(@post_fix_pos)
+        log(message, newline: false)
+        @reline.erase_after_cursor
+      end
+
+      def set_prefix message
+        @prefix = "#{color('»', :bold, :cyan)} #{color(message, :green)}"
+        @post_fix_pos = HighLine::Wrapper.actual_length(@prefix) + 1
+      end
+
+      def clear_prefix
+        @prefix = ''
+        @post_fix_pos = 0
+        clear_line
+      end
+
+      def clear_line
+        @reline.move_cursor_column(0)
+        @reline.erase_after_cursor
+      end
+
+      def spin
+        return unless (Time.now - @last_spin) > 0.2
+
+        write_after color(@spinner[@spindex], :bold, :red)
+        @spindex = (@spindex + 1) % @spinner.length
+        @last_spin = Time.now
+      end
+
+      def cleanup(newline = true)
+        @reline.show_cursor
+        log('') if newline
+      end
+    end
+  end
+end

data/lib/brakeman/messages.rb

@@ -86,7 +86,7 @@ class Brakeman::Messages::Message
   end
 
   def to_html
-    require 'cgi'
+    require 'cgi/escape'
 
     output = @parts.map(&:to_html).join
 

data/lib/brakeman/options.rb

@@ -63,14 +63,22 @@ module Brakeman::Options
           options[:exit_on_error] = exit_on_error
         end
 
-        opts.on "--ensure-latest", "Fail when Brakeman is outdated" do
-          options[:ensure_latest] = true
+        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days." do |days|
+          if days and not (1..15).include? days
+            raise OptionParser::InvalidArgument
+          end
+
+          options[:ensure_latest] = days || true
         end
 
         opts.on "--ensure-ignore-notes", "Fail when an ignored warnings does not include a note" do
           options[:ensure_ignore_notes] = true
         end
 
+        opts.on "--ensure-no-obsolete-ignore-entries", "Fail when an obsolete ignore entry is found" do
+          options[:ensure_no_obsolete_ignore_entries] = true
+        end
+
         opts.on "-3", "--rails3", "Force Rails 3 mode" do
           options[:rails3] = true
         end
@@ -127,7 +135,6 @@ module Brakeman::Options
 
         opts.on "--faster", "Faster, but less accurate scan" do
           options[:ignore_ifs] = true
-          options[:skip_libs] = true
           options[:disable_constant_tracking] = true
         end
 
@@ -139,10 +146,6 @@ module Brakeman::Options
           options[:ignore_attr_protected] = true
         end
 
-        opts.on "--[no-]index-libs", "Add libraries to call index (Default)" do |index|
-          options[:index_libs] = index
-        end
-
         opts.on "--interprocedural", "Process method calls to known methods" do
           options[:interprocedural] = true
         end
@@ -161,14 +164,13 @@ module Brakeman::Options
 
         opts.on "--[no-]prism", "Use the Prism parser" do |use_prism|
           if use_prism
-            prism_version = '0.30'
+            min_prism_version = '1.0.0'
 
             begin
-              # Specifying minimum version here,
-              # since it can't be in the gem dependency list because it is optional
-              gem 'prism', "~>#{prism_version}"
+              gem 'prism', ">=#{min_prism_version}"
+              require 'prism'
             rescue Gem::MissingSpecVersionError, Gem::MissingSpecError, Gem::LoadError => e
-              $stderr.puts "Please install `prism` version #{prism_version} or newer:"
+              $stderr.puts "Please install `prism` version #{min_prism_version} or newer:"
               raise e
             end
           end
@@ -209,10 +211,6 @@ module Brakeman::Options
           options[:skip_vendor] = skip
         end
 
-        opts.on "--skip-libs", "Skip processing lib directory" do
-          options[:skip_libs] = true
-        end
-
         opts.on "--add-libs-path path1,path2,etc", Array, "An application relative lib directory (ex. app/mailers) to process" do |paths|
           options[:additional_libs_path] ||= Set.new
           options[:additional_libs_path].merge paths
@@ -223,6 +221,14 @@ module Brakeman::Options
           options[:engine_paths].merge paths
         end
 
+        opts.on '--[no-]follow-symlinks', 'Follow symbolic links for directions' do |follow_symlinks|
+          options[:follow_symlinks] = follow_symlinks
+        end
+
+        opts.on '--gemfile GEMFILE', 'Specify Gemfile to scan' do |gemfile|
+          options[:gemfile] = gemfile
+        end
+
         opts.on "-E", "--enable Check1,Check2,etc", Array, "Enable the specified checks" do |checks|
           checks.map! do |check|
             if check.start_with? "Check"

data/lib/brakeman/parsers/haml6_embedded.rb

@@ -0,0 +1,23 @@
+[:Coffee, :CoffeeScript, :Markdown, :Sass].each do |name|
+  klass = Module.const_get("Haml::Filters::#{name}")
+
+  klass.define_method(:compile) do |node|
+    temple = [:multi]
+    temple << [:static, "<script>\n"]
+    temple << compile_with_tilt(node)
+    temple << [:static, "</script>"]
+    temple
+  end
+
+  klass.define_method(:compile_with_tilt) do |node|
+    # From Haml
+    text = ::Haml::Util.unescape_interpolation(node.value[:text]).gsub(/(\\+)n/) do |s|
+      escapes = $1.size
+      next s if escapes % 2 == 0
+      "#{'\\' * (escapes - 1)}\n"
+    end
+    text.prepend("\n").sub!(/\n"\z/, '"')
+
+    [:dynamic, "BrakemanFilter.render(#{text})"]
+  end
+end

data/lib/brakeman/parsers/rails_erubi.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+# Copied almost verbatim from Rails
+# https://github.com/rails/rails/blob/5359cf8a5b093b04170e884ee8da5a1e076b8a0d/actionview/lib/action_view/template/handlers/erb/erubi.rb#L9
+
+Brakeman.load_brakeman_dependency "erubi"
+
+module Brakeman
+  class Erubi < ::Erubi::Engine
+    # :nodoc: all
+    def initialize(input, properties = {})
+      @newline_pending = 0
+
+      # Dup properties so that we don't modify argument
+      properties = Hash[properties]
+
+      properties[:bufvar]     ||= "@output_buffer"
+      properties[:preamble]   ||= ""
+      properties[:postamble]  ||= "#{properties[:bufvar]}"
+
+      # Tell Erubi whether the template will be compiled with `frozen_string_literal: true`
+      # properties[:freeze_template_literals] = !Template.frozen_string_literal
+      properties[:freeze_template_literals] = false
+
+      properties[:escapefunc] = ""
+
+      super
+    end
+
+  private
+    def add_text(text)
+      return if text.empty?
+
+      if text == "\n"
+        @newline_pending += 1
+      else
+        with_buffer do
+          src << ".safe_append='"
+          src << "\n" * @newline_pending if @newline_pending > 0
+          src << text.gsub(/['\\]/, '\\\\\&') << @text_end
+        end
+        @newline_pending = 0
+      end
+    end
+
+    BLOCK_EXPR = /((\s|\))do|\{)(\s*\|[^|]*\|)?\s*\Z/
+
+    def add_expression(indicator, code)
+      flush_newline_if_pending(src)
+
+      with_buffer do
+        if (indicator == "==") || @escape
+          src << ".safe_expr_append="
+        else
+          src << ".append="
+        end
+
+        if BLOCK_EXPR.match?(code)
+          src << " " << code
+        else
+          src << "(" << code << ")"
+        end
+      end
+    end
+
+    def add_code(code)
+      flush_newline_if_pending(src)
+      super
+    end
+
+    def add_postamble(_)
+      flush_newline_if_pending(src)
+      super
+    end
+
+    def flush_newline_if_pending(src)
+      if @newline_pending > 0
+        with_buffer { src << ".safe_append='#{"\n" * @newline_pending}" << @text_end }
+        @newline_pending = 0
+      end
+    end
+  end
+end

data/lib/brakeman/parsers/template_parser.rb

@@ -21,9 +21,10 @@ module Brakeman
       begin
         src = case type
               when :erb
-                type = :erubis if erubis?
+                type = :erubi if erubi?
                 parse_erb path, text
               when :haml
+                type = :haml6 if haml6?
                 parse_haml path, text
               when :slim
                 parse_slim path, text
@@ -45,17 +46,9 @@ module Brakeman
     end
 
     def parse_erb path, text
-      if tracker.config.escape_html?
-        if tracker.options[:rails3]
-          require 'brakeman/parsers/rails3_erubis'
-          Brakeman::Rails3Erubis.new(text, :filename => path).src
-        else
-          require 'brakeman/parsers/rails2_xss_plugin_erubis'
-          Brakeman::Rails2XSSPluginErubis.new(text, :filename => path).src
-        end
-      elsif tracker.config.erubis?
-        require 'brakeman/parsers/rails2_erubis'
-        Brakeman::ScannerErubis.new(text, :filename => path).src
+      if erubi?
+        require 'brakeman/parsers/rails_erubi'
+        Brakeman::Erubi.new(text, :filename => path).src
       else
         require 'erb'
         src = if ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+
@@ -68,25 +61,49 @@ module Brakeman
       end
     end
 
-    def erubis?
+    def erubi?
       tracker.config.escape_html? or
-        tracker.config.erubis?
+        tracker.config.erubi?
     end
 
     def parse_haml path, text
-      Brakeman.load_brakeman_dependency 'haml'
-      require_relative 'haml_embedded'
+      if haml6?
+        require_relative 'haml6_embedded'
+
+        Haml::Template.new(filename: path.relative,
+                           :escape_html => tracker.config.escape_html?,
+                           generator: Temple::Generators::RailsOutputBuffer,
+                           use_html_safe: true,
+                           buffer_class: 'ActionView::OutputBuffer',
+                           disable_capture: true,
+                          ) { text }.precompiled_template
+      else
+        require_relative 'haml_embedded'
 
-      Haml::Engine.new(text,
-                       :filename => path,
-                       :escape_html => tracker.config.escape_html?,
-                       :escape_filter_interpolations => tracker.config.escape_filter_interpolations?
-                      ).precompiled.gsub(/([^\\])\\n/, '\1')
+        Haml::Engine.new(text,
+                         :filename => path,
+                         :escape_html => tracker.config.escape_html?,
+                         :escape_filter_interpolations => tracker.config.escape_filter_interpolations?
+                        ).precompiled.gsub(/([^\\])\\n/, '\1')
+      end
     rescue Haml::Error => e
       tracker.error e, ["While compiling HAML in #{path}"] << e.backtrace
       nil
     end
 
+    def haml6?
+      return @haml6 unless @haml6.nil?
+
+      Brakeman.load_brakeman_dependency 'haml'
+      major_version = Haml::VERSION.split('.').first.to_i
+
+      if major_version >= 6
+        @haml6 = true
+      else
+        @haml6 = false
+      end
+    end
+
     def parse_slim path, text
       Brakeman.load_brakeman_dependency 'slim'
 
@@ -123,7 +140,7 @@ module Brakeman
       fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
       tp = self.new(tracker, fp)
       src = tp.parse_erb '_inline_', text
-      type = tp.erubis? ? :erubis : :erb
+      type = tp.erubi? ? :erubi : :erb
 
       return type, fp.parse_ruby(src, "_inline_")
     end

data/lib/brakeman/processor.rb

@@ -63,8 +63,10 @@ module Brakeman
         result = ErbTemplateProcessor.new(@tracker, name, called_from, file_name).process src
       when :haml
         result = HamlTemplateProcessor.new(@tracker, name, called_from, file_name).process src
-      when :erubis
-        result = ErubisTemplateProcessor.new(@tracker, name, called_from, file_name).process src
+      when :haml6
+        result = Haml6TemplateProcessor.new(@tracker, name, called_from, file_name).process src
+      when :erubi
+        result = ErubiTemplateProcessor.new(@tracker, name, called_from, file_name).process src
       when :slim
         result = SlimTemplateProcessor.new(@tracker, name, called_from, file_name).process src
       else

data/lib/brakeman/processors/alias_processor.rb

@@ -97,6 +97,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   end
 
   def process_bracket_call exp
+    # TODO: What is even happening in this method?
     r = replace(exp)
 
     if r != exp
@@ -127,7 +128,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
         return r
       end
     else
-      t = nil
+      t = exp.target # put it back?
     end
 
     if hash? t
@@ -242,6 +243,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
         exp = math_op(method, target, first_arg, exp)
       end
     when :[]
+      # TODO: This might never be used because of process_bracket_call above
       if array? target
         exp = process_array_access(target, exp.args, exp)
       elsif hash? target
@@ -268,7 +270,7 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       end
     when :<<
       if string? target and string? first_arg
-        target.value << first_arg.value
+        target.value += first_arg.value
         env[target_var] = target
         return target
       elsif string? target and string_interp? first_arg
@@ -276,8 +278,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
         env[target_var] = exp
       elsif string? first_arg and string_interp? target
         if string? target.last
-          target.last.value << first_arg.value
+          target.last.value += first_arg.value
         elsif target.last.is_a? String
+          # TODO Use target.last += ?
           target.last << first_arg.value
         else
           target << first_arg
@@ -433,6 +436,12 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       exp.method == :open
   end
 
+  def temp_file_create? exp
+    call? exp and
+      exp.target == TEMP_FILE_CLASS and
+      exp.method == :create
+  end
+
   def temp_file_new line
     s(:call, TEMP_FILE_CLASS, :new).line(line)
   end
@@ -462,6 +471,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
       elsif temp_file_open? call
         local = Sexp.new(:lvar, block_args.last)
         env.current[local] = temp_file_new(exp.line)
+      elsif temp_file_create? call
+        local = Sexp.new(:lvar, block_args.last)
+        env.current[local] = temp_file_new(exp.line)
       else
         block_args.each do |e|
           #Force block arg(s) to be local
@@ -666,7 +678,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
     end
 
     unless array? exp[1] and array? exp[2]
-      return process_default(exp)
+      # Already processed RHS, don't do it again
+      # https://github.com/presidentbeef/brakeman/issues/1877
+      return exp
     end
 
     vars = exp[1].dup

data/lib/brakeman/processors/base_processor.rb

@@ -205,6 +205,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     rest = process rest
     result = Sexp.new(:render, render_type, value, rest)
     result.line(exp.line)
+
     result
   end
 
@@ -240,6 +241,7 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     elsif first_arg.nil?
       type = :default
     elsif not hash? first_arg
+      # Maybe do partial if in view?
       type = :action
       value = first_arg
     end
@@ -256,12 +258,19 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     #Look for "type" of render in options hash
     #For example, render :file => "blah"
     if hash? last_arg
-      hash_iterate(last_arg) do |key, val|
-        if symbol? key and types_in_hash.include? key.value
-          type = key.value
-          value = val
-        else  
-          rest << key << val
+      if type
+        #The render type was already determined by a positional argument, so a
+        #key in the options hash that happens to match a render type name (e.g.
+        #`text:`) is a local passed to the partial/action, not a type directive.
+        rest = last_arg
+      else
+        hash_iterate(last_arg) do |key, val|
+          if symbol? key and types_in_hash.include? key.value
+            type = key.value
+            value = val
+          else
+            rest << key << val
+          end
         end
       end
     end