brakeman 7.1.1 → 7.1.2

data/bundle/ruby/{3.1.0/gems/ruby_parser-3.20.3 → 3.2.0/gems/ruby_parser-3.22.0}/lib/ruby_parser_extras.rb

@@ -1,6 +1,4 @@
-# encoding: ASCII-8BIT
 # frozen_string_literal: true
-# TODO: remove encoding comment
 
 require "sexp"
 require "ruby_lexer"
@@ -30,11 +28,11 @@ class Sexp
 end
 
 module RubyParserStuff
-  VERSION = "3.20.3"
+  VERSION = "3.22.0"
 
   attr_accessor :lexer, :in_def, :in_single, :file, :in_argdef
   attr_accessor :in_kwarg
-  attr_reader :env, :comments
+  attr_reader :env
 
   ##
   # Canonicalize conditionals. Eg:
@@ -92,8 +90,6 @@ module RubyParserStuff
     [k, true]
   }.to_h
 
-  has_enc = "".respond_to? :encoding
-
   # This is in sorted order of occurrence according to
   # charlock_holmes against 500k files, with UTF_8 forced
   # to the top.
@@ -107,7 +103,7 @@ module RubyParserStuff
     Encoding::SHIFT_JIS,
     Encoding::WINDOWS_1252,
     Encoding::EUC_JP
-  ] if has_enc
+  ]
 
   JUMP_TYPE = [:return, :next, :break, :yield].map { |k| [k, true] }.to_h
 
@@ -125,7 +121,6 @@ module RubyParserStuff
     self.in_argdef = false
 
     @env = RubyParserStuff::Environment.new
-    @comments = []
 
     @canonicalize_conditions = true
 
@@ -225,8 +220,8 @@ module RubyParserStuff
   end
 
   def endless_method_name defn_or_defs
-    name = defn_or_defs[1]
-    name = defn_or_defs[2] unless Symbol === name
+    _, name, maybe_name, * = defn_or_defs
+    name = maybe_name unless Symbol === name
 
     if attrset_id? name then
       yyerror "setter method cannot be defined in an endless method definition"
@@ -254,6 +249,36 @@ module RubyParserStuff
   end
 
   def assignable(lhs, value = nil)
+    id, line = lhs.last, lhs.line
+
+    result =
+      case lhs.sexp_type
+      when :const then
+        s(:cdecl, id)
+      when :cvar then
+        asgn = in_def || in_single > 0
+        s((asgn ? :cvasgn : :cvdecl), id)
+      when :gvar then
+        s(:gasgn, id)
+      when :ivar then
+        s(:iasgn, id)
+      else
+        case self.env[id]
+        when :lvar, :dvar, nil then
+          self.env[id] ||= :lvar
+          s(:lasgn, id)
+        else
+          raise "wtf? unknown type: #{self.env[id]}"
+        end
+      end
+
+    result << value if value
+    result.line line
+
+    result
+  end
+
+  def old_assignable(lhs, value = nil)
     id, line = lhs
     id = id.to_sym
 
@@ -339,7 +364,7 @@ module RubyParserStuff
       when Sexp then
         case arg.sexp_type
         when :array, :args, :call_args then # HACK? remove array at some point
-          result.concat arg.sexp_body
+          result.sexp_body += arg.sexp_body
         else
           result << arg
         end
@@ -567,14 +592,13 @@ module RubyParserStuff
 
   def handle_encoding str
     str = str.dup
-    has_enc = str.respond_to? :encoding
     encoding = nil
 
     header = str.each_line.first(2)
-    header.map! { |s| s.force_encoding "ASCII-8BIT" } if has_enc
+    header.map! { |s| s.force_encoding "ASCII-8BIT" }
 
     first = header.first || ""
-    encoding, str = +"utf-8", str.b[3..-1] if first =~ /\A\xEF\xBB\xBF/
+    encoding, str = +"utf-8", str.b[3..-1] if first =~ /\A\xEF\xBB\xBF/n
 
     encoding = $1.strip if header.find { |s|
       s[/^#.*?-\*-.*?coding:\s*([^ ;]+).*?-\*-/, 1] ||
@@ -582,15 +606,11 @@ module RubyParserStuff
     }
 
     if encoding then
-      if has_enc then
-        encoding.sub!(/utf-8-.+$/, "utf-8") # HACK for stupid emacs formats
-        hack_encoding str, encoding
-      else
-        warn "Skipping magic encoding comment"
-      end
+      encoding.sub!(/utf-8-.+$/, "utf-8") # HACK for stupid emacs formats
+      hack_encoding str, encoding
     else
       # nothing specified... ugh. try to encode as utf-8
-      hack_encoding str if has_enc
+      hack_encoding str
     end
 
     str
@@ -645,13 +665,20 @@ module RubyParserStuff
     when :dstr then
       if htype == :str then
         lineno = head.line
-        tail[1] = head.last + tail[1]
+        _, h1 = head
+        _, t1, *rest = tail
+        tail.sexp_body = [h1 + t1, *rest]
+
         head = tail
         head.line = lineno
       else
         tail.sexp_type = :array
-        tail[1] = s(:str, tail[1]).line tail.line
-        tail.delete_at 1 if tail[1] == s(:str, "")
+        _, tail_s, *tail_r = tail
+        if tail_s == "" then
+          tail.sexp_body = tail_r
+        else
+          tail.sexp_body = [s(:str, tail_s).line(tail.line), *tail_r]
+        end
 
         head.push(*tail.sexp_body)
       end
@@ -663,8 +690,11 @@ module RubyParserStuff
         head.line = l
       end
 
-      if head.size == 2 and tail.size > 1 and tail[1].sexp_type == :str then
-        head.last << tail[1].last
+      _, t1, * = tail
+      if head.size == 2 and tail.size > 1 and t1.sexp_type == :str then
+        _, h1 = head
+        head.sexp_body = [h1.dup] if h1.frozen? # this is dumb
+        head.last << t1.last
         head.sexp_type = :str if head.size == 2 # HACK ?
       else
         head.push(tail)
@@ -846,7 +876,7 @@ module RubyParserStuff
 
       while res do
         result << res
-        res = res.resbody(true)
+        res = res.find_node :resbody, :delete
       end
 
       result << elsebody if elsebody
@@ -915,8 +945,9 @@ module RubyParserStuff
       body = body.delete_at 3
     end
 
-    result[2..-1].each do |node|
-      block = node.block(:delete)
+    _, _expr, *cases = result
+    cases.each do |node|
+      block = node.find_node :block, :delete
       node.concat block.sexp_body if block
     end
 
@@ -929,7 +960,7 @@ module RubyParserStuff
   end
 
   def new_class val
-    (_, line), path, superclass, _, body, (_, line_max) = val
+    (_, line, comment), path, superclass, _, body, (_, line_max) = val
 
     path = path.first if path.instance_of? Array
 
@@ -945,7 +976,7 @@ module RubyParserStuff
 
     result.line = line
     result.line_max = line_max
-    result.comments = self.comments.pop
+    result.comments = comment if comment
     result
   end
 
@@ -973,7 +1004,11 @@ module RubyParserStuff
   end
 
   def new_defn val
-    _, (name, line), in_def, args, body, (_, line_max) = val
+    if val.size == 4 then
+      ((_, line, comment), (name, _line, in_def)), args, body, (_, line_max) = val
+    else
+      (_, line, comment), (name, line), in_def, args, body, (_, line_max) = val
+    end
 
     body ||= s(:nil).line line
 
@@ -988,13 +1023,14 @@ module RubyParserStuff
       result.push body
     end
 
-    result.comments = self.comments.pop
+    result.comments = comment if comment
 
     [result, in_def]
   end
 
   def new_endless_defn val
-    (name, line, in_def), args, _, body, _, resbody = val
+    # not available in 2.x so we don't need to check size
+    ((_, line, comment), (name, _, in_def)), args, _, body, _, resbody = val
 
     result =
       if resbody then
@@ -1009,13 +1045,15 @@ module RubyParserStuff
     local_pop in_def
     endless_method_name result
 
-    result.comments = self.comments.pop
+    result.comments = comment if comment
 
     result
   end
 
   def new_endless_defs val
-    (recv, (name, line, in_def)), args, _, body, _, resbody = val
+    # not available in 2.x so we don't need to check size
+    ((_, line, comment), recv, _, _, (name, line, in_def)), \
+      args, _, body, _, resbody = val
 
     result =
       if resbody then
@@ -1031,13 +1069,19 @@ module RubyParserStuff
     local_pop in_def
     endless_method_name result
 
-    result.comments = self.comments.pop
+    result.comments = comment if comment
 
     result
   end
 
   def new_defs val
-    _, recv, (name, line), in_def, args, body, (_, line_max) = val
+    if val.size == 4 then
+      ((_, line, comment), recv, _, _, (name, line, in_def)), \
+        args, body, (_, line_max) = val
+    else
+      (_, line, comment), recv, (name, _), in_def, \
+        args, body, (_, line_max) = val
+    end
 
     body ||= s(:nil).line line
 
@@ -1055,7 +1099,7 @@ module RubyParserStuff
       result.push body
     end
 
-    result.comments = self.comments.pop
+    result.comments = comment if comment
 
     [result, in_def]
   end
@@ -1115,8 +1159,7 @@ module RubyParserStuff
 
     if kw_rest_arg then
       name = kw_rest_arg.value
-      # TODO: I _hate_ this:
-      assignable [name, kw_rest_arg.line] if name != :**
+      assignable kw_rest_arg if name != :**
       result << kw_rest_arg
     end
 
@@ -1209,7 +1252,7 @@ module RubyParserStuff
   end
 
   def new_module val
-    (_, line_min), path, _, body, (_, line_max) = val
+    (_, line_min, comment), path, _, body, (_, line_max) = val
 
     path = path.first if path.instance_of? Array
 
@@ -1224,7 +1267,7 @@ module RubyParserStuff
       end
     end
 
-    result.comments = self.comments.pop
+    result.comments = comment if comment
     result
   end
 
@@ -1319,23 +1362,25 @@ module RubyParserStuff
 
     case node.sexp_type
     when :str then
+      _, str = node
       node.sexp_type = :lit
-      node[1] = if k then
-                  Regexp.new(node[1], o, k)
-                else
-                  begin
-                    Regexp.new(node[1], o)
-                  rescue RegexpError => e
-                    warn "WARNING: #{e.message} for #{node[1].inspect} #{options.inspect}"
-                    begin
-                      warn "WARNING: trying to recover with ENC_UTF8"
-                      Regexp.new(node[1], Regexp::ENC_UTF8)
-                    rescue RegexpError => e
-                      warn "WARNING: trying to recover with ENC_NONE"
-                      Regexp.new(node[1], Regexp::ENC_NONE)
-                    end
-                  end
+      val = if k then
+              Regexp.new(str, o, k)
+            else
+              begin
+                Regexp.new(str, o)
+              rescue RegexpError => e
+                warn "WARNING: #{e.message} for #{str.inspect} #{options.inspect}"
+                begin
+                  warn "WARNING: trying to recover with ENC_UTF8"
+                  Regexp.new(str, Regexp::ENC_UTF8)
+                rescue RegexpError => e
+                  warn "WARNING: trying to recover with ENC_NONE"
+                  Regexp.new(str, Regexp::ENC_NONE)
                 end
+              end
+            end
+      node.sexp_body = [val]
     when :dstr then
       if options =~ /o/ then
         node.sexp_type = :dregx_once
@@ -1518,11 +1563,16 @@ module RubyParserStuff
     end
   end
 
+  KEEP_COMMENT_TOKENS = [:kCLASS, :kMODULE, :kDEF, :tNL]
+
   def next_token
     token = self.lexer.next_token
 
     if token and token.first != RubyLexer::EOF then
       self.last_token_type = token
+
+      self.lexer.comment = nil unless KEEP_COMMENT_TOKENS.include? token.first
+
       return token
     elsif !token
       return self.lexer.next_token
@@ -1553,7 +1603,7 @@ module RubyParserStuff
 
       self.lexer.string = handle_encoding str
 
-      self.file = file.dup
+      self.file = file
 
       @yydebug = ENV.has_key? "DEBUG"
 
@@ -1582,7 +1632,6 @@ module RubyParserStuff
     self.in_def = false
     self.in_single = 0
     self.env.reset
-    self.comments.clear
     self.last_token_type = nil
   end
 

data/bundle/ruby/{3.1.0/gems/sexp_processor-4.17.4 → 3.2.0/gems/sexp_processor-4.17.5}/History.rdoc

@@ -1,3 +1,9 @@
+=== 4.17.5 / 2025-12-24
+
+* 1 minor enhancement:
+
+  * Bumped ruby to 3.2+.
+
 === 4.17.4 / 2025-09-02
 
 This release was brought to you by ScotRail free WiFi!

data/bundle/ruby/{3.1.0/gems/sexp_processor-4.17.4 → 3.2.0/gems/sexp_processor-4.17.5}/lib/sexp_processor.rb

@@ -34,7 +34,7 @@ require "sexp"
 class SexpProcessor
 
   # duh
-  VERSION = "4.17.4"
+  VERSION = "4.17.5"
 
   ##
   # Automatically shifts off the Sexp type before handing the

data/bundle/ruby/{3.1.0/gems/unicode-emoji-4.1.0 → 3.2.0/gems/unicode-emoji-4.2.0}/CHANGELOG.md

@@ -1,5 +1,11 @@
 # CHANGELOG
 
+## 4.2.0
+
+- Allow Ruby 4.0
+- Remove Non-Emoji pictographs from spec, since they have been removed in Unicode 17
+- Update valid subdivisions to CLDR 48 (no changes)
+
 ## 4.1.0
 
 - Unicode 17

data/bundle/ruby/{3.1.0/gems/unicode-emoji-4.1.0 → 3.2.0/gems/unicode-emoji-4.2.0}/Gemfile

@@ -4,4 +4,6 @@ gemspec
 
 gem "minitest"
 gem "rake"
+gem "mutex_m"
+gem "ostruct"
 gem "irb" unless RUBY_ENGINE == "jruby"

data/bundle/ruby/{3.1.0/gems/unicode-emoji-4.1.0 → 3.2.0/gems/unicode-emoji-4.2.0}/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    unicode-emoji (4.1.0)
+    unicode-emoji (4.2.0)
 
 GEM
   remote: https://rubygems.org/
@@ -11,6 +11,8 @@ GEM
       rdoc
       reline (>= 0.3.8)
     minitest (5.20.0)
+    mutex_m (0.3.0)
+    ostruct (0.6.3)
     psych (5.1.0)
       stringio
     rake (13.0.6)
@@ -26,6 +28,8 @@ PLATFORMS
 DEPENDENCIES
   irb
   minitest
+  mutex_m
+  ostruct
   rake
   unicode-emoji!
 

data/bundle/ruby/{3.1.0/gems/unicode-emoji-4.1.0 → 3.2.0/gems/unicode-emoji-4.2.0}/lib/unicode/emoji/constants.rb

@@ -2,9 +2,10 @@
 
 module Unicode
   module Emoji
-    VERSION = "4.1.0"
+    VERSION = "4.2.0"
     EMOJI_VERSION = "17.0"
-    CLDR_VERSION = "47"
+    UNICODE_VERSION = "17.0.0"
+    CLDR_VERSION = "48"
     DATA_DIRECTORY = File.expand_path('../../../data', __dir__).freeze
     INDEX_FILENAME = (DATA_DIRECTORY + "/emoji.marshal.gz").freeze
 

data/bundle/ruby/{3.1.0/gems/unicode-emoji-4.1.0 → 3.2.0/gems/unicode-emoji-4.2.0}/unicode-emoji.gemspec

@@ -18,5 +18,5 @@ Gem::Specification.new do |gem|
   gem.require_paths = ["lib"]
   gem.metadata      = { "rubygems_mfa_required" => "true" }
 
-  gem.required_ruby_version = ">= 2.5", "< 4.0"
+  gem.required_ruby_version = ">= 2.5"
 end

data/lib/brakeman/checks/check_sql.rb

@@ -188,18 +188,20 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
                       when :find_by_sql, :count_by_sql
                         check_by_sql_arguments call.first_arg
                       when :calculate
-                        if call.arglist.length > 2
+                        if call.num_args > 2
                           unsafe_sql?(call.second_arg) or check_find_arguments(call.third_arg)
-                        elsif call.arglist.length > 1
+                        elsif call.num_args > 1
                           unsafe_sql?(call.second_arg)
                         end
                       when :last, :first, :all
                         check_find_arguments call.first_arg
                       when :average, :count, :maximum, :minimum, :sum
-                        if call.arglist.length > 1
-                          unsafe_sql?(call.first_arg) or check_find_arguments(call.last_arg)
+                        if call.num_args > 1
+                          if version_between?("0.0.0", "4.9.9") # In Rails 5+ these do not accept multiple arguments
+                            check_find_arguments(call.first_arg) or check_find_arguments(call.second_arg)
+                          end
                         else
-                          check_find_arguments call.last_arg
+                          check_find_arguments call.first_arg
                         end
                       when :where, :rewhere, :having, :find_by, :find_by!, :find_or_create_by, :find_or_create_by!, :find_or_initialize_by,:not, :delete_by, :destroy_by
                         check_query_arguments call.arglist

data/lib/brakeman/processors/haml_template_processor.rb

@@ -166,7 +166,16 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
   def haml_attribute_builder? exp
     call? exp and
       exp.target == ATTRIBUTE_BUILDER and
-      (exp.method == :build or exp.method == :build_id)
+      escaped_builder_method? exp
+  end
+
+  def escaped_builder_method? exp
+    case exp.method
+    when :build, :build_aria, :build_boolean, :build_data, :build_id, :escape_html
+      true? exp.first_arg
+    else
+      false
+    end
   end
 
   def fix_textareas? exp

data/lib/brakeman/processors/lib/rails2_config_processor.rb

@@ -51,7 +51,7 @@ class Brakeman::Rails2ConfigProcessor < Brakeman::BasicProcessor
     if exp.target == RAILS_CONFIG
       #Get rid of '=' at end
       attribute = exp.method.to_s[0..-2].to_sym
-      if exp.args.length > 1
+      if exp.num_args > 1
         #Multiple arguments?...not sure if this will ever happen
         @tracker.config.rails[attribute] = exp.args
       else

data/lib/brakeman/processors/lib/rails3_config_processor.rb

@@ -78,7 +78,7 @@ class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
     if exp.target == RAILS_CONFIG
       #Get rid of '=' at end
       attribute = exp.method.to_s[0..-2].to_sym
-      if exp.args.length > 1
+      if exp.num_args > 1
         #Multiple arguments?...not sure if this will ever happen
         @tracker.config.rails[attribute] = exp.args
       else

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "7.1.1"
+  Version = "7.1.2"
 end

data/lib/ruby_parser/bm_sexp.rb

@@ -172,6 +172,20 @@ class Sexp
     self[2] = name
   end
 
+  # Number of arguments in a method call.
+  def num_args
+    expect :call, :attrasgn, :safe_call, :safe_attrasgn, :super, :zsuper
+
+    case self.node_type
+    when :call, :attrasgn, :safe_call, :safe_attrasgn
+      self.length - 3
+    when :super
+      self.length - 1
+    when :zsuper
+      0
+    end
+  end
+
   #Sets the arglist in a method call.
   def arglist= exp
     expect :call, :attrasgn, :safe_call, :safe_attrasgn