brakeman 7.1.2 → 8.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +11 -0
  3. data/README.md +1 -1
  4. data/bundle/load.rb +2 -2
  5. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/CHANGELOG +111 -0
  6. data/bundle/ruby/3.2.0/gems/{erubis-2.7.0 → erubi-1.13.1}/MIT-LICENSE +1 -0
  7. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/README.rdoc +151 -0
  8. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_block.rb +91 -0
  9. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_end.rb +58 -0
  10. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi.rb +299 -0
  11. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/asciidoc.rb +12 -5
  12. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/babel.rb +5 -0
  13. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/builder.rb +4 -0
  14. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/coffee.rb +14 -4
  15. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/commonmarker.rb +41 -0
  16. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/csv.rb +63 -0
  17. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/erb.rb +130 -0
  18. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/erubi.rb +41 -8
  19. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/etanni.rb +7 -0
  20. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/haml.rb +67 -1
  21. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/kramdown.rb +59 -0
  22. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/liquid.rb +93 -0
  23. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/livescript.rb +11 -4
  24. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/mapping.rb +8 -8
  25. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/markaby.rb +11 -2
  26. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/nokogiri.rb +13 -2
  27. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/pandoc.rb +81 -0
  28. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/pipeline.rb +6 -1
  29. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/plain.rb +5 -1
  30. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/prawn.rb +17 -6
  31. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/radius.rb +96 -0
  32. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rdiscount.rb +82 -0
  33. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rdoc.rb +33 -0
  34. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/redcarpet.rb +73 -0
  35. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/redcloth.rb +40 -0
  36. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rst-pandoc.rb +33 -0
  37. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/sass.rb +16 -3
  38. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/slim.rb +18 -0
  39. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/string.rb +10 -2
  40. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/template.rb +5 -5
  41. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/typescript.rb +5 -0
  42. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/yajl.rb +91 -0
  43. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt.rb +1 -2
  44. data/lib/brakeman/app_tree.rb +7 -2
  45. data/lib/brakeman/checks/check_model_attributes.rb +1 -1
  46. data/lib/brakeman/checks/check_render.rb +1 -27
  47. data/lib/brakeman/checks/check_render_rce.rb +43 -0
  48. data/lib/brakeman/checks/check_session_settings.rb +1 -1
  49. data/lib/brakeman/checks.rb +31 -25
  50. data/lib/brakeman/commandline.rb +6 -1
  51. data/lib/brakeman/file_parser.rb +3 -2
  52. data/lib/brakeman/logger.rb +264 -0
  53. data/lib/brakeman/options.rb +0 -9
  54. data/lib/brakeman/parsers/rails_erubi.rb +82 -0
  55. data/lib/brakeman/parsers/template_parser.rb +7 -15
  56. data/lib/brakeman/processor.rb +2 -2
  57. data/lib/brakeman/processors/controller_alias_processor.rb +1 -1
  58. data/lib/brakeman/processors/controller_processor.rb +3 -3
  59. data/lib/brakeman/processors/{erubis_template_processor.rb → erubi_template_procesor.rb} +3 -3
  60. data/lib/brakeman/processors/lib/rails2_config_processor.rb +4 -3
  61. data/lib/brakeman/processors/lib/rails2_route_processor.rb +1 -1
  62. data/lib/brakeman/processors/lib/render_helper.rb +1 -1
  63. data/lib/brakeman/processors/lib/render_path.rb +1 -1
  64. data/lib/brakeman/processors/model_processor.rb +1 -1
  65. data/lib/brakeman/report/ignore/config.rb +1 -1
  66. data/lib/brakeman/scanner.rb +25 -49
  67. data/lib/brakeman/tracker/collection.rb +12 -2
  68. data/lib/brakeman/tracker/config.rb +17 -13
  69. data/lib/brakeman/tracker/constants.rb +17 -2
  70. data/lib/brakeman/tracker/controller.rb +1 -1
  71. data/lib/brakeman/tracker.rb +7 -15
  72. data/lib/brakeman/version.rb +1 -1
  73. data/lib/brakeman.rb +89 -49
  74. metadata +51 -80
  75. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/CHANGES.txt +0 -828
  76. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/README.txt +0 -102
  77. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/erubis +0 -3468
  78. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/erubis-run.rb +0 -132
  79. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/inline-require +0 -179
  80. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/context.rb +0 -83
  81. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/converter.rb +0 -357
  82. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ec.rb +0 -117
  83. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ecpp.rb +0 -113
  84. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ejava.rb +0 -110
  85. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ejavascript.rb +0 -119
  86. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/enhanced.rb +0 -126
  87. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/eperl.rb +0 -95
  88. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ephp.rb +0 -99
  89. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/eruby.rb +0 -125
  90. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/escheme.rb +0 -114
  91. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/optimized.rb +0 -127
  92. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine.rb +0 -120
  93. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/enhancer.rb +0 -723
  94. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/error.rb +0 -23
  95. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/evaluator.rb +0 -88
  96. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/generator.rb +0 -85
  97. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helper.rb +0 -47
  98. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helpers/rails_form_helper.rb +0 -197
  99. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helpers/rails_helper.rb +0 -353
  100. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/local-setting.rb +0 -9
  101. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/main.rb +0 -516
  102. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/preprocessing.rb +0 -58
  103. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/tiny.rb +0 -144
  104. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/util.rb +0 -22
  105. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis.rb +0 -73
  106. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/setup.rb +0 -1331
  107. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/creole.rb +0 -16
  108. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/csv.rb +0 -53
  109. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/erb.rb +0 -65
  110. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/kramdown.rb +0 -13
  111. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/liquid.rb +0 -37
  112. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/pandoc.rb +0 -39
  113. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/radius.rb +0 -41
  114. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rdiscount.rb +0 -23
  115. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rdoc.rb +0 -11
  116. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/redcarpet.rb +0 -31
  117. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/redcloth.rb +0 -13
  118. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rst-pandoc.rb +0 -10
  119. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/slim.rb +0 -5
  120. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/yajl.rb +0 -81
  121. data/lib/brakeman/parsers/erubis_patch.rb +0 -11
  122. data/lib/brakeman/parsers/rails2_erubis.rb +0 -9
  123. data/lib/brakeman/parsers/rails2_xss_plugin_erubis.rb +0 -52
  124. data/lib/brakeman/parsers/rails3_erubis.rb +0 -85
  125. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/COPYING +0 -0
  126. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_emacs_org.rb +0 -0
  127. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_handlebars.rb +0 -0
  128. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_jbuilder.rb +0 -0
  129. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_org.rb +0 -0
  130. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/cli.rb +0 -0
@@ -1,127 +0,0 @@
1
- ##
2
- ## $Release: 2.7.0 $
3
- ## copyright(c) 2006-2011 kuwata-lab.com all rights reserved.
4
- ##
5
-
6
-
7
- require 'erubis/engine/eruby'
8
-
9
-
10
- module Erubis
11
-
12
-
13
- module OptimizedGenerator
14
- include Generator
15
-
16
- def self.supported_properties() # :nodoc:
17
- return []
18
- end
19
-
20
- def init_generator(properties={})
21
- super
22
- @escapefunc ||= "Erubis::XmlHelper.escape_xml"
23
- @initialized = false
24
- @prev_is_expr = false
25
- end
26
-
27
- protected
28
-
29
- def escape_text(text)
30
- text.gsub(/['\\]/, '\\\\\&') # "'" => "\\'", '\\' => '\\\\'
31
- end
32
-
33
- def escaped_expr(code)
34
- @escapefunc ||= 'Erubis::XmlHelper.escape_xml'
35
- return "#{@escapefunc}(#{code})"
36
- end
37
-
38
- def switch_to_expr(src)
39
- return if @prev_is_expr
40
- @prev_is_expr = true
41
- src << ' _buf'
42
- end
43
-
44
- def switch_to_stmt(src)
45
- return unless @prev_is_expr
46
- @prev_is_expr = false
47
- src << ';'
48
- end
49
-
50
- def add_preamble(src)
51
- #@initialized = false
52
- #@prev_is_expr = false
53
- end
54
-
55
- def add_text(src, text)
56
- return if text.empty?
57
- if @initialized
58
- switch_to_expr(src)
59
- src << " << '" << escape_text(text) << "'"
60
- else
61
- src << "_buf = '" << escape_text(text) << "';"
62
- @initialized = true
63
- end
64
- end
65
-
66
- def add_stmt(src, code)
67
- switch_to_stmt(src) if @initialized
68
- #super
69
- src << code
70
- src << ';' unless code[-1] == ?\n
71
- end
72
-
73
- def add_expr_literal(src, code)
74
- unless @initialized; src << "_buf = ''"; @initialized = true; end
75
- switch_to_expr(src)
76
- src << " << (" << code << ").to_s"
77
- end
78
-
79
- def add_expr_escaped(src, code)
80
- unless @initialized; src << "_buf = ''"; @initialized = true; end
81
- switch_to_expr(src)
82
- src << " << " << escaped_expr(code)
83
- end
84
-
85
- def add_expr_debug(src, code)
86
- code.strip!
87
- s = (code.dump =~ /\A"(.*)"\z/) && $1
88
- src << ' $stderr.puts("*** debug: ' << s << '=#{(' << code << ').inspect}");'
89
- end
90
-
91
- def add_postamble(src)
92
- #super if @initialized
93
- src << "\n_buf\n" if @initialized
94
- end
95
-
96
- end # end of class OptimizedEruby
97
-
98
-
99
- ##
100
- ## Eruby class which generates optimized ruby code
101
- ##
102
- class OptimizedEruby < Basic::Engine # Eruby
103
- include RubyEvaluator
104
- include OptimizedGenerator
105
-
106
- def init_converter(properties={})
107
- @pi = 'rb'
108
- super(properties)
109
- end
110
-
111
- end
112
-
113
-
114
- ##
115
- ## XmlEruby class which generates optimized ruby code
116
- ##
117
- class OptimizedXmlEruby < OptimizedEruby
118
- include EscapeEnhancer
119
-
120
- def add_expr_debug(src, code)
121
- switch_to_stmt(src) if indicator == '===' && !@initialized
122
- super
123
- end
124
-
125
- end # end of class OptimizedXmlEruby
126
-
127
- end
@@ -1,120 +0,0 @@
1
- ##
2
- ## $Release: 2.7.0 $
3
- ## copyright(c) 2006-2011 kuwata-lab.com all rights reserved.
4
- ##
5
-
6
-
7
- require 'erubis/generator'
8
- require 'erubis/converter'
9
- require 'erubis/evaluator'
10
- require 'erubis/context'
11
-
12
-
13
- module Erubis
14
-
15
-
16
- ##
17
- ## (abstract) abstract engine class.
18
- ## subclass must include evaluator and converter module.
19
- ##
20
- class Engine
21
- #include Evaluator
22
- #include Converter
23
- #include Generator
24
-
25
- def initialize(input=nil, properties={})
26
- #@input = input
27
- init_generator(properties)
28
- init_converter(properties)
29
- init_evaluator(properties)
30
- @src = convert(input) if input
31
- end
32
-
33
-
34
- ##
35
- ## convert input string and set it to @src
36
- ##
37
- def convert!(input)
38
- @src = convert(input)
39
- end
40
-
41
-
42
- ##
43
- ## load file, write cache file, and return engine object.
44
- ## this method create code cache file automatically.
45
- ## cachefile name can be specified with properties[:cachename],
46
- ## or filname + 'cache' is used as default.
47
- ##
48
- def self.load_file(filename, properties={})
49
- cachename = properties[:cachename] || (filename + '.cache')
50
- properties[:filename] = filename
51
- timestamp = File.mtime(filename)
52
- if test(?f, cachename) && timestamp == File.mtime(cachename)
53
- engine = self.new(nil, properties)
54
- engine.src = File.read(cachename)
55
- else
56
- input = File.open(filename, 'rb') {|f| f.read }
57
- engine = self.new(input, properties)
58
- tmpname = cachename + rand().to_s[1,8]
59
- File.open(tmpname, 'wb') {|f| f.write(engine.src) }
60
- File.rename(tmpname, cachename)
61
- File.utime(timestamp, timestamp, cachename)
62
- end
63
- engine.src.untaint # ok?
64
- return engine
65
- end
66
-
67
-
68
- ##
69
- ## helper method to convert and evaluate input text with context object.
70
- ## context may be Binding, Hash, or Object.
71
- ##
72
- def process(input, context=nil, filename=nil)
73
- code = convert(input)
74
- filename ||= '(erubis)'
75
- if context.is_a?(Binding)
76
- return eval(code, context, filename)
77
- else
78
- context = Context.new(context) if context.is_a?(Hash)
79
- return context.instance_eval(code, filename)
80
- end
81
- end
82
-
83
-
84
- ##
85
- ## helper method evaluate Proc object with contect object.
86
- ## context may be Binding, Hash, or Object.
87
- ##
88
- def process_proc(proc_obj, context=nil, filename=nil)
89
- if context.is_a?(Binding)
90
- filename ||= '(erubis)'
91
- return eval(proc_obj, context, filename)
92
- else
93
- context = Context.new(context) if context.is_a?(Hash)
94
- return context.instance_eval(&proc_obj)
95
- end
96
- end
97
-
98
-
99
- end # end of class Engine
100
-
101
-
102
- ##
103
- ## (abstract) base engine class for Eruby, Eperl, Ejava, and so on.
104
- ## subclass must include generator.
105
- ##
106
- class Basic::Engine < Engine
107
- include Evaluator
108
- include Basic::Converter
109
- include Generator
110
- end
111
-
112
-
113
- class PI::Engine < Engine
114
- include Evaluator
115
- include PI::Converter
116
- include Generator
117
- end
118
-
119
-
120
- end