brakeman 7.0.2 → 7.1.1

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/parsers/baseparser.rb

@@ -144,6 +144,7 @@ module REXML
         PEREFERENCE_PATTERN = /#{PEREFERENCE}/um
         TAG_PATTERN = /((?>#{QNAME_STR}))\s*/um
         CLOSE_PATTERN = /(#{QNAME_STR})\s*>/um
+        EQUAL_PATTERN = /\s*=\s*/um
         ATTLISTDECL_END = /\s+#{NAME}(?:#{ATTDEF})*\s*>/um
         NAME_PATTERN = /#{NAME}/um
         GEDECL_PATTERN = "\\s+#{NAME}\\s+#{ENTITYDEF}\\s*>"
@@ -168,6 +169,7 @@ module REXML
         @entity_expansion_limit = Security.entity_expansion_limit
         @entity_expansion_text_limit = Security.entity_expansion_text_limit
         @source.ensure_buffer
+        @version = nil
       end
 
       def add_listener( listener )
@@ -206,12 +208,12 @@ module REXML
 
       # Returns true if there are no more events
       def empty?
-        return (@source.empty? and @stack.empty?)
+        (@source.empty? and @stack.empty?)
       end
 
       # Returns true if there are more events.  Synonymous with !empty?
       def has_next?
-        return !(@source.empty? and @stack.empty?)
+        !(@source.empty? and @stack.empty?)
       end
 
       # Push an event back on the head of the stream.  This method
@@ -264,6 +266,11 @@ module REXML
             path = "/" + @tags.join("/")
             raise ParseException.new("Missing end tag for '#{path}'", @source)
           end
+
+          unless @document_status == :in_element
+            raise ParseException.new("Malformed XML: No root element", @source)
+          end
+
           return [ :end_document ]
         end
         return @stack.shift if @stack.size > 0
@@ -277,17 +284,10 @@ module REXML
             return process_instruction
           elsif @source.match?("<!", true)
             if @source.match?("--", true)
-              md = @source.match(/(.*?)-->/um, true)
-              if md.nil?
-                raise REXML::ParseException.new("Unclosed comment", @source)
-              end
-              if /--|-\z/.match?(md[1])
-                raise REXML::ParseException.new("Malformed comment", @source)
-              end
-              return [ :comment, md[1] ]
+              return [ :comment, process_comment ]
             elsif @source.match?("DOCTYPE", true)
               base_error_message = "Malformed DOCTYPE"
-              unless @source.match?(/\s+/um, true)
+              unless @source.skip_spaces
                 if @source.match?(">")
                   message = "#{base_error_message}: name is missing"
                 else
@@ -297,7 +297,7 @@ module REXML
                 raise REXML::ParseException.new(message, @source)
               end
               name = parse_name(base_error_message)
-              @source.match?(/\s*/um, true) # skip spaces
+              @source.skip_spaces
               if @source.match?("[", true)
                 id = [nil, nil, nil]
                 @document_status = :in_doctype
@@ -313,7 +313,7 @@ module REXML
                   # For backward compatibility
                   id[1], id[2] = id[2], nil
                 end
-                @source.match?(/\s*/um, true) # skip spaces
+                @source.skip_spaces
                 if @source.match?("[", true)
                   @document_status = :in_doctype
                 elsif @source.match?(">", true)
@@ -326,7 +326,7 @@ module REXML
               end
               args = [:start_doctype, name, *id]
               if @document_status == :after_doctype
-                @source.match?(/\s*/um, true)
+                @source.skip_spaces
                 @stack << [ :end_doctype ]
               end
               return args
@@ -337,7 +337,7 @@ module REXML
           end
         end
         if @document_status == :in_doctype
-          @source.match?(/\s*/um, true) # skip spaces
+          @source.skip_spaces
           start_position = @source.position
           if @source.match?("<!", true)
             if @source.match?("ELEMENT", true)
@@ -398,7 +398,7 @@ module REXML
               return [ :attlistdecl, element, pairs, contents ]
             elsif @source.match?("NOTATION", true)
               base_error_message = "Malformed notation declaration"
-              unless @source.match?(/\s+/um, true)
+              unless @source.skip_spaces
                 if @source.match?(">")
                   message = "#{base_error_message}: name is missing"
                 else
@@ -411,31 +411,28 @@ module REXML
               id = parse_id(base_error_message,
                             accept_external_id: true,
                             accept_public_id: true)
-              @source.match?(/\s*/um, true) # skip spaces
+              @source.skip_spaces
               unless @source.match?(">", true)
                 message = "#{base_error_message}: garbage before end >"
                 raise REXML::ParseException.new(message, @source)
               end
               return [:notationdecl, name, *id]
-            elsif md = @source.match(/--(.*?)-->/um, true)
-              case md[1]
-              when /--/, /-\z/
-                raise REXML::ParseException.new("Malformed comment", @source)
-              end
-              return [ :comment, md[1] ] if md
+            elsif @source.match?("--", true)
+              return [ :comment, process_comment ]
+            else
+              raise REXML::ParseException.new("Malformed node: Started with '<!' but not a comment nor ELEMENT,ENTITY,ATTLIST,NOTATION", @source)
             end
           elsif match = @source.match(/(%.*?;)\s*/um, true)
             return [ :externalentity, match[1] ]
           elsif @source.match?(/\]\s*>/um, true)
             @document_status = :after_doctype
             return [ :end_doctype ]
-          end
-          if @document_status == :in_doctype
+          else
             raise ParseException.new("Malformed DOCTYPE: invalid declaration", @source)
           end
         end
         if @document_status == :after_doctype
-          @source.match?(/\s*/um, true)
+          @source.skip_spaces
         end
         begin
           start_position = @source.position
@@ -460,23 +457,19 @@ module REXML
               end
               return [ :end_element, last_tag ]
             elsif @source.match?("!", true)
-              md = @source.match(/([^>]*>)/um)
               #STDERR.puts "SOURCE BUFFER = #{source.buffer}, #{source.buffer.size}"
-              raise REXML::ParseException.new("Malformed node", @source) unless md
-              if md[0][0] == ?-
-                md = @source.match(/--(.*?)-->/um, true)
-
-                if md.nil? || /--|-\z/.match?(md[1])
-                  raise REXML::ParseException.new("Malformed comment", @source)
+              if @source.match?("--", true)
+                return [ :comment, process_comment ]
+              elsif @source.match?("[CDATA[", true)
+                text = @source.read_until("]]>")
+                if text.chomp!("]]>")
+                  return [ :cdata, text ]
+                else
+                  raise REXML::ParseException.new("Malformed CDATA: Missing end ']]>'", @source)
                 end
-
-                return [ :comment, md[1] ]
               else
-                md = @source.match(/\[CDATA\[(.*?)\]\]>/um, true)
-                return [ :cdata, md[1] ] if md
+                raise REXML::ParseException.new("Malformed node: Started with '<!' but not a comment nor CDATA", @source)
               end
-              raise REXML::ParseException.new( "Declarations can only occur "+
-                "in the doctype declaration.", @source)
             elsif @source.match?("?", true)
               return process_instruction
             else
@@ -536,7 +529,8 @@ module REXML
           raise REXML::ParseException.new( "Exception parsing",
             @source, self, (error ? error : $!) )
         end
-        return [ :dummy ]
+        # NOTE: The end of the method never runs, because it is unreachable.
+        #       All branches of code above have explicit unconditional return or raise statements.
       end
       private :pull_event
 
@@ -655,6 +649,10 @@ module REXML
         true
       end
 
+      def normalize_xml_declaration_encoding(xml_declaration_encoding)
+        /\AUTF-16(?:BE|LE)\z/i.match?(xml_declaration_encoding) ? "UTF-16" : nil
+      end
+
       def parse_name(base_error_message)
         md = @source.match(Private::NAME_PATTERN, true)
         unless md
@@ -734,39 +732,99 @@ module REXML
         end
       end
 
+      def process_comment
+        text = @source.read_until("-->")
+        unless text.chomp!("-->")
+          raise REXML::ParseException.new("Unclosed comment: Missing end '-->'", @source)
+        end
+
+        if text.include? "--" or text.end_with?("-")
+          raise REXML::ParseException.new("Malformed comment", @source)
+        end
+        text
+      end
+
       def process_instruction
         name = parse_name("Malformed XML: Invalid processing instruction node")
-        if @source.match?(/\s+/um, true)
-          match_data = @source.match(/(.*?)\?>/um, true)
-          unless match_data
-            raise ParseException.new("Malformed XML: Unclosed processing instruction", @source)
+        if name == "xml"
+          xml_declaration
+        else # PITarget
+          if @source.skip_spaces # e.g. <?name content?>
+            start_position = @source.position
+            content = @source.read_until("?>")
+            unless content.chomp!("?>")
+              @source.position = start_position
+              raise ParseException.new("Malformed XML: Unclosed processing instruction: <#{name}>", @source)
+            end
+          else # e.g. <?name?>
+            content = nil
+            unless @source.match?("?>", true)
+              raise ParseException.new("Malformed XML: Unclosed processing instruction: <#{name}>", @source)
+            end
           end
-          content = match_data[1]
-        else
-          content = nil
+          [:processing_instruction, name, content]
+        end
+      end
+
+      def xml_declaration
+        unless @version.nil?
+          raise ParseException.new("Malformed XML: XML declaration is duplicated", @source)
+        end
+        if @document_status
+          raise ParseException.new("Malformed XML: XML declaration is not at the start", @source)
+        end
+        unless @source.skip_spaces
+          raise ParseException.new("Malformed XML: XML declaration misses spaces before version", @source)
+        end
+        unless @source.match?("version", true)
+          raise ParseException.new("Malformed XML: XML declaration misses version", @source)
+        end
+        @version = parse_attribute_value_with_equal("xml")
+        unless @source.skip_spaces
           unless @source.match?("?>", true)
-            raise ParseException.new("Malformed XML: Unclosed processing instruction", @source)
+            raise ParseException.new("Malformed XML: Unclosed XML declaration", @source)
           end
+          encoding = normalize_xml_declaration_encoding(@source.encoding)
+          return [ :xmldecl, @version, encoding, nil ] # e.g. <?xml version="1.0"?>
         end
-        if name == "xml"
-          if @document_status
-            raise ParseException.new("Malformed XML: XML declaration is not at the start", @source)
-          end
-          version = VERSION.match(content)
-          version = version[1] unless version.nil?
-          encoding = ENCODING.match(content)
-          encoding = encoding[1] unless encoding.nil?
-          if need_source_encoding_update?(encoding)
-            @source.encoding = encoding
+
+        if @source.match?("encoding", true)
+          encoding = parse_attribute_value_with_equal("xml")
+          unless @source.skip_spaces
+            unless @source.match?("?>", true)
+              raise ParseException.new("Malformed XML: Unclosed XML declaration", @source)
+            end
+            if need_source_encoding_update?(encoding)
+              @source.encoding = encoding
+            end
+            encoding ||= normalize_xml_declaration_encoding(@source.encoding)
+            return [ :xmldecl, @version, encoding, nil ] # e.g. <?xml version="1.1" encoding="UTF-8"?>
           end
-          if encoding.nil? and /\AUTF-16(?:BE|LE)\z/i =~ @source.encoding
-            encoding = "UTF-16"
+        end
+
+        if @source.match?("standalone", true)
+          standalone = parse_attribute_value_with_equal("xml")
+          case standalone
+          when "yes", "no"
+          else
+            raise ParseException.new("Malformed XML: XML declaration standalone is not yes or no : <#{standalone}>", @source)
           end
-          standalone = STANDALONE.match(content)
-          standalone = standalone[1] unless standalone.nil?
-          return [ :xmldecl, version, encoding, standalone ]
         end
-        [:processing_instruction, name, content]
+        @source.skip_spaces
+        unless @source.match?("?>", true)
+          raise ParseException.new("Malformed XML: Unclosed XML declaration", @source)
+        end
+
+        if need_source_encoding_update?(encoding)
+          @source.encoding = encoding
+        end
+        encoding ||= normalize_xml_declaration_encoding(@source.encoding)
+
+        # e.g. <?xml version="1.0" ?>
+        #      <?xml version="1.1" encoding="UTF-8" ?>
+        #      <?xml version="1.1" standalone="yes"?>
+        #      <?xml version="1.1" encoding="UTF-8" standalone="yes" ?>
+        [ :xmldecl, @version, encoding, standalone ]
       end
 
       if StringScanner::Version < "3.1.1"
@@ -788,6 +846,25 @@ module REXML
         end
       end
 
+      def parse_attribute_value_with_equal(name)
+        unless @source.match?(Private::EQUAL_PATTERN, true)
+          message = "Missing attribute equal: <#{name}>"
+          raise REXML::ParseException.new(message, @source)
+        end
+        unless quote = scan_quote
+          message = "Missing attribute value start quote: <#{name}>"
+          raise REXML::ParseException.new(message, @source)
+        end
+        start_position = @source.position
+        value = @source.read_until(quote)
+        unless value.chomp!(quote)
+          @source.position = start_position
+          message = "Missing attribute value end quote: <#{name}>: <#{quote}>"
+          raise REXML::ParseException.new(message, @source)
+        end
+        value
+      end
+
       def parse_attributes(prefixes)
         attributes = {}
         expanded_names = {}
@@ -802,23 +879,8 @@ module REXML
             name = match[1]
             prefix = match[2]
             local_part = match[3]
-
-            unless @source.match?(/\s*=\s*/um, true)
-              message = "Missing attribute equal: <#{name}>"
-              raise REXML::ParseException.new(message, @source)
-            end
-            unless quote = scan_quote
-              message = "Missing attribute value start quote: <#{name}>"
-              raise REXML::ParseException.new(message, @source)
-            end
-            start_position = @source.position
-            value = @source.read_until(quote)
-            unless value.chomp!(quote)
-              @source.position = start_position
-              message = "Missing attribute value end quote: <#{name}>: <#{quote}>"
-              raise REXML::ParseException.new(message, @source)
-            end
-            @source.match?(/\s*/um, true)
+            value = parse_attribute_value_with_equal(name)
+            @source.skip_spaces
             if prefix == "xmlns"
               if local_part == "xml"
                 if value != Private::XML_PREFIXED_NAMESPACE

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/parsers/xpathparser.rb

@@ -215,7 +215,7 @@ module REXML
         else
           path << yield( parsed )
         end
-        return path.squeeze(" ")
+        path.squeeze(" ")
       end
       # For backward compatibility
       alias_method :preciate_to_string, :predicate_to_path
@@ -252,7 +252,7 @@ module REXML
             path = path[1..-1]
           end
         end
-        return RelativeLocationPath( path, parsed ) if path.size > 0
+        RelativeLocationPath( path, parsed ) if path.size > 0
       end
 
       #RelativeLocationPath
@@ -388,7 +388,7 @@ module REXML
         else
           path = original_path
         end
-        return path
+        path
       end
 
       # Filters the supplied nodeset on the predicate(s)
@@ -600,7 +600,7 @@ module REXML
         end
         rest = LocationPath(rest, n) if rest =~ /\A[\/\.\@\[\w*]/
         parsed.concat(n)
-        return rest
+        rest
       end
 
       #| FilterExpr Predicate

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/quickpath.rb

@@ -41,7 +41,7 @@ module REXML
       else
         results = filter([element], path)
       end
-      return results
+      results
     end
 
     # Given an array of nodes it filters the array based on the path. The
@@ -51,18 +51,18 @@ module REXML
       return elements if path.nil? or path == '' or elements.size == 0
       case path
       when /^\/\//u                                                                                     # Descendant
-        return axe( elements, "descendant-or-self", $' )
+        axe( elements, "descendant-or-self", $' )
       when /^\/?\b(\w[-\w]*)\b::/u                                                      # Axe
-        return axe( elements, $1, $' )
+        axe( elements, $1, $' )
       when /^\/(?=\b([:!\w][-\.\w]*:)?[-!\*\.\w]*\b([^:(]|$)|\*)/u      # Child
         rest = $'
         results = []
         elements.each do |element|
           results |= filter( element.to_a, rest )
         end
-        return results
+        results
       when /^\/?(\w[-\w]*)\(/u                                                  # / Function
-        return function( elements, $1, $' )
+        function( elements, $1, $' )
       when Namespace::NAMESPLIT         # Element name
         name = $2
         ns = $1
@@ -73,21 +73,21 @@ module REXML
              (element.name == name and
               element.namespace == Functions.namespace_context[ns])))
         end
-        return filter( elements, rest )
+        filter( elements, rest )
       when /^\/\[/u
         matches = []
         elements.each do |element|
           matches |= predicate( element.to_a, path[1..-1] ) if element.kind_of? Element
         end
-        return matches
+        matches
       when /^\[/u                                                                                               # Predicate
-        return predicate( elements, path )
+        predicate( elements, path )
       when /^\/?\.\.\./u                                                                                # Ancestor
-        return axe( elements, "ancestor", $' )
+        axe( elements, "ancestor", $' )
       when /^\/?\.\./u                                                                                  # Parent
-        return filter( elements.collect{|e|e.parent}, $' )
+        filter( elements.collect{|e|e.parent}, $' )
       when /^\/?\./u                                                                                            # Self
-        return filter( elements, $' )
+        filter( elements, $' )
       when /^\*/u                                                                                                       # Any
         results = []
         elements.each do |element|
@@ -98,9 +98,10 @@ module REXML
           #     results |= filter( children, $' )
           #end
         end
-        return results
+        results
+      else
+        []
       end
-      return []
     end
 
     def QuickPath::axe( elements, axe_name, rest )
@@ -138,7 +139,7 @@ module REXML
         matches = filter(elements.collect{|element|
           element.previous_sibling}.uniq, rest )
       end
-      return matches.uniq
+      matches.uniq
     end
 
     OPERAND_ = '((?=(?:(?!and|or).)*[^\s<>=])[^\s<>=]+)'
@@ -200,15 +201,15 @@ module REXML
           results << element
         end
       end
-      return filter( results, rest )
+      filter( results, rest )
     end
 
     def QuickPath::attribute( name )
-      return Functions.node.attributes[name] if Functions.node.kind_of? Element
+      Functions.node.attributes[name] if Functions.node.kind_of? Element
     end
 
     def QuickPath::name()
-      return Functions.node.name if Functions.node.kind_of? Element
+      Functions.node.name if Functions.node.kind_of? Element
     end
 
     def QuickPath::method_missing( id, *args )
@@ -234,7 +235,7 @@ module REXML
           results << element if Functions.pair[0] == res
         end
       end
-      return results
+      results
     end
 
     def QuickPath::parse_args( element, string )

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/rexml.rb

@@ -31,7 +31,7 @@
 module REXML
   COPYRIGHT = "Copyright © 2001-2008 Sean Russell <ser@germane-software.com>"
   DATE = "2008/019"
-  VERSION = "3.4.1"
+  VERSION = "3.4.4"
   REVISION = ""
 
   Copyright = COPYRIGHT

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/security.rb

@@ -10,7 +10,7 @@ module REXML
 
     # Get the entity expansion limit. By default the limit is set to 10000.
     def self.entity_expansion_limit
-      return @@entity_expansion_limit
+      @@entity_expansion_limit
     end
 
     @@entity_expansion_text_limit = 10_240
@@ -22,7 +22,7 @@ module REXML
 
     # Get the entity expansion limit. By default the limit is set to 10240.
     def self.entity_expansion_text_limit
-      return @@entity_expansion_text_limit
+      @@entity_expansion_text_limit
     end
   end
 end

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/source.rb

@@ -65,9 +65,10 @@ module REXML
     attr_reader :encoding
 
     module Private
+      SPACES_PATTERN = /\s+/um
       SCANNER_RESET_SIZE = 100000
       PRE_DEFINED_TERM_PATTERNS = {}
-      pre_defined_terms = ["'", '"', "<"]
+      pre_defined_terms = ["'", '"', "<", "]]>", "?>"]
       if StringScanner::Version < "3.1.1"
         pre_defined_terms.each do |term|
           PRE_DEFINED_TERM_PATTERNS[term] = /#{Regexp.escape(term)}/
@@ -150,6 +151,10 @@ module REXML
       end
     end
 
+    def skip_spaces
+      @scanner.skip(Private::SPACES_PATTERN) ? true : false
+    end
+
     def position
       @scanner.pos
     end
@@ -267,7 +272,7 @@ module REXML
         @scanner << readline(term)
       end
       if str
-        read if @scanner.eos? and !@source.eof?
+        read if @scanner.eos? and @source and !@source.eof?
         str
       else
         rest = @scanner.rest

data/bundle/ruby/3.1.0/gems/{rexml-3.4.1 → rexml-3.4.4}/lib/rexml/text.rb

@@ -104,16 +104,16 @@ module REXML
       @entity_filter = entity_filter if entity_filter
       clear_cache
 
-      Text.check(@string, illegal, doctype) if @raw
+      Text.check(@string, illegal) if @raw
     end
 
     def parent= parent
       super(parent)
-      Text.check(@string, NEEDS_A_SECOND_CHECK, doctype) if @raw and @parent
+      Text.check(@string, NEEDS_A_SECOND_CHECK) if @raw and @parent
     end
 
     # check for illegal characters
-    def Text.check string, pattern, doctype
+    def Text.check string, pattern, doctype = nil
 
       # illegal anywhere
       if !string.match?(VALID_XML_CHARS)
@@ -177,7 +177,7 @@ module REXML
 
 
     def clone
-      return Text.new(self, true)
+      Text.new(self, true)
     end
 
 
@@ -200,10 +200,7 @@ module REXML
     end
 
     def doctype
-      if @parent
-        doc = @parent.document
-        doc.doctype if doc
-      end
+      @parent&.document&.doctype
     end
 
     REFERENCE = /#{Entity::REFERENCE}/
@@ -264,30 +261,32 @@ module REXML
       # Recursively wrap string at width.
       return string if string.length <= width
       place = string.rindex(' ', width) # Position in string with last ' ' before cutoff
-      if addnewline then
-        return "\n" + string[0,place] + "\n" + wrap(string[place+1..-1], width)
+      if addnewline
+        "\n" + string[0,place] + "\n" + wrap(string[place+1..-1], width)
       else
-        return string[0,place] + "\n" + wrap(string[place+1..-1], width)
+        string[0,place] + "\n" + wrap(string[place+1..-1], width)
       end
     end
 
     def indent_text(string, level=1, style="\t", indentfirstline=true)
+      Kernel.warn("#{self.class.name}#indent_text is deprecated. See REXML::Formatters", uplevel: 1)
       return string if level < 0
-      new_string = ''
+
+      new_string = +''
       string.each_line { |line|
         indent_string = style * level
         new_line = (indent_string + line).sub(/[\s]+$/,'')
         new_string << new_line
       }
       new_string.strip! unless indentfirstline
-      return new_string
+      new_string
     end
 
     # == DEPRECATED
     # See REXML::Formatters
     #
     def write( writer, indent=-1, transitive=false, ie_hack=false )
-      Kernel.warn("#{self.class.name}.write is deprecated.  See REXML::Formatters", uplevel: 1)
+      Kernel.warn("#{self.class.name}#write is deprecated.  See REXML::Formatters", uplevel: 1)
       formatter = if indent > -1
           REXML::Formatters::Pretty.new( indent )
         else
@@ -299,9 +298,7 @@ module REXML
     # FIXME
     # This probably won't work properly
     def xpath
-      path = @parent.xpath
-      path += "/text()"
-      return path
+      @parent.xpath + "/text()"
     end
 
     # Writes out text, substituting special characters beforehand.