brakeman 7.1.2 → 8.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (130) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGES.md +11 -0
  3. data/README.md +1 -1
  4. data/bundle/load.rb +2 -2
  5. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/CHANGELOG +111 -0
  6. data/bundle/ruby/3.2.0/gems/{erubis-2.7.0 → erubi-1.13.1}/MIT-LICENSE +1 -0
  7. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/README.rdoc +151 -0
  8. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_block.rb +91 -0
  9. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi/capture_end.rb +58 -0
  10. data/bundle/ruby/3.2.0/gems/erubi-1.13.1/lib/erubi.rb +299 -0
  11. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/asciidoc.rb +12 -5
  12. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/babel.rb +5 -0
  13. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/builder.rb +4 -0
  14. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/coffee.rb +14 -4
  15. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/commonmarker.rb +41 -0
  16. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/csv.rb +63 -0
  17. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/erb.rb +130 -0
  18. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/erubi.rb +41 -8
  19. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/etanni.rb +7 -0
  20. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/haml.rb +67 -1
  21. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/kramdown.rb +59 -0
  22. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/liquid.rb +93 -0
  23. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/livescript.rb +11 -4
  24. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/mapping.rb +8 -8
  25. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/markaby.rb +11 -2
  26. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/nokogiri.rb +13 -2
  27. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/pandoc.rb +81 -0
  28. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/pipeline.rb +6 -1
  29. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/plain.rb +5 -1
  30. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/prawn.rb +17 -6
  31. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/radius.rb +96 -0
  32. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rdiscount.rb +82 -0
  33. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rdoc.rb +33 -0
  34. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/redcarpet.rb +73 -0
  35. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/redcloth.rb +40 -0
  36. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/rst-pandoc.rb +33 -0
  37. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/sass.rb +16 -3
  38. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/slim.rb +18 -0
  39. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/string.rb +10 -2
  40. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/template.rb +5 -5
  41. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/typescript.rb +5 -0
  42. data/bundle/ruby/3.2.0/gems/tilt-2.7.0/lib/tilt/yajl.rb +91 -0
  43. data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt.rb +1 -2
  44. data/lib/brakeman/app_tree.rb +7 -2
  45. data/lib/brakeman/checks/check_model_attributes.rb +1 -1
  46. data/lib/brakeman/checks/check_render.rb +1 -27
  47. data/lib/brakeman/checks/check_render_rce.rb +43 -0
  48. data/lib/brakeman/checks/check_session_settings.rb +1 -1
  49. data/lib/brakeman/checks.rb +31 -25
  50. data/lib/brakeman/commandline.rb +6 -1
  51. data/lib/brakeman/file_parser.rb +3 -2
  52. data/lib/brakeman/logger.rb +264 -0
  53. data/lib/brakeman/options.rb +0 -9
  54. data/lib/brakeman/parsers/rails_erubi.rb +82 -0
  55. data/lib/brakeman/parsers/template_parser.rb +7 -15
  56. data/lib/brakeman/processor.rb +2 -2
  57. data/lib/brakeman/processors/controller_alias_processor.rb +1 -1
  58. data/lib/brakeman/processors/controller_processor.rb +3 -3
  59. data/lib/brakeman/processors/{erubis_template_processor.rb → erubi_template_procesor.rb} +3 -3
  60. data/lib/brakeman/processors/lib/rails2_config_processor.rb +4 -3
  61. data/lib/brakeman/processors/lib/rails2_route_processor.rb +1 -1
  62. data/lib/brakeman/processors/lib/render_helper.rb +1 -1
  63. data/lib/brakeman/processors/lib/render_path.rb +1 -1
  64. data/lib/brakeman/processors/model_processor.rb +1 -1
  65. data/lib/brakeman/report/ignore/config.rb +1 -1
  66. data/lib/brakeman/scanner.rb +25 -49
  67. data/lib/brakeman/tracker/collection.rb +12 -2
  68. data/lib/brakeman/tracker/config.rb +17 -13
  69. data/lib/brakeman/tracker/constants.rb +17 -2
  70. data/lib/brakeman/tracker/controller.rb +1 -1
  71. data/lib/brakeman/tracker.rb +7 -15
  72. data/lib/brakeman/version.rb +1 -1
  73. data/lib/brakeman.rb +89 -49
  74. metadata +51 -80
  75. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/CHANGES.txt +0 -828
  76. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/README.txt +0 -102
  77. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/erubis +0 -3468
  78. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/erubis-run.rb +0 -132
  79. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/contrib/inline-require +0 -179
  80. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/context.rb +0 -83
  81. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/converter.rb +0 -357
  82. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ec.rb +0 -117
  83. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ecpp.rb +0 -113
  84. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ejava.rb +0 -110
  85. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ejavascript.rb +0 -119
  86. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/enhanced.rb +0 -126
  87. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/eperl.rb +0 -95
  88. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/ephp.rb +0 -99
  89. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/eruby.rb +0 -125
  90. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/escheme.rb +0 -114
  91. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine/optimized.rb +0 -127
  92. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/engine.rb +0 -120
  93. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/enhancer.rb +0 -723
  94. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/error.rb +0 -23
  95. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/evaluator.rb +0 -88
  96. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/generator.rb +0 -85
  97. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helper.rb +0 -47
  98. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helpers/rails_form_helper.rb +0 -197
  99. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/helpers/rails_helper.rb +0 -353
  100. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/local-setting.rb +0 -9
  101. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/main.rb +0 -516
  102. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/preprocessing.rb +0 -58
  103. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/tiny.rb +0 -144
  104. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis/util.rb +0 -22
  105. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/lib/erubis.rb +0 -73
  106. data/bundle/ruby/3.2.0/gems/erubis-2.7.0/setup.rb +0 -1331
  107. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/creole.rb +0 -16
  108. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/csv.rb +0 -53
  109. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/erb.rb +0 -65
  110. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/kramdown.rb +0 -13
  111. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/liquid.rb +0 -37
  112. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/pandoc.rb +0 -39
  113. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/radius.rb +0 -41
  114. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rdiscount.rb +0 -23
  115. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rdoc.rb +0 -11
  116. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/redcarpet.rb +0 -31
  117. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/redcloth.rb +0 -13
  118. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/rst-pandoc.rb +0 -10
  119. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/slim.rb +0 -5
  120. data/bundle/ruby/3.2.0/gems/tilt-2.6.1/lib/tilt/yajl.rb +0 -81
  121. data/lib/brakeman/parsers/erubis_patch.rb +0 -11
  122. data/lib/brakeman/parsers/rails2_erubis.rb +0 -9
  123. data/lib/brakeman/parsers/rails2_xss_plugin_erubis.rb +0 -52
  124. data/lib/brakeman/parsers/rails3_erubis.rb +0 -85
  125. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/COPYING +0 -0
  126. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_emacs_org.rb +0 -0
  127. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_handlebars.rb +0 -0
  128. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_jbuilder.rb +0 -0
  129. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/_org.rb +0 -0
  130. /data/bundle/ruby/3.2.0/gems/{tilt-2.6.1 → tilt-2.7.0}/lib/tilt/cli.rb +0 -0
@@ -1,144 +0,0 @@
1
- ##
2
- ## $Release: 2.7.0 $
3
- ## copyright(c) 2006-2011 kuwata-lab.com all rights reserved.
4
- ##
5
-
6
- module Erubis
7
-
8
- ##
9
- ## tiny and the simplest implementation of eRuby
10
- ##
11
- ## ex.
12
- ## eruby = TinyEruby.new(File.read('example.rhtml'))
13
- ## print eruby.src # print ruby code
14
- ## print eruby.result(binding()) # eval ruby code with Binding object
15
- ## print eruby.evalute(context) # eval ruby code with context object
16
- ##
17
- class TinyEruby
18
-
19
- def initialize(input=nil)
20
- @src = convert(input) if input
21
- end
22
- attr_reader :src
23
-
24
- EMBEDDED_PATTERN = /<%(=+|\#)?(.*?)-?%>/m
25
-
26
- def convert(input)
27
- src = "_buf = '';" # preamble
28
- pos = 0
29
- input.scan(EMBEDDED_PATTERN) do |indicator, code|
30
- m = Regexp.last_match
31
- text = input[pos...m.begin(0)]
32
- pos = m.end(0)
33
- #src << " _buf << '" << escape_text(text) << "';"
34
- text.gsub!(/['\\]/, '\\\\\&')
35
- src << " _buf << '" << text << "';" unless text.empty?
36
- if !indicator # <% %>
37
- src << code << ";"
38
- elsif indicator == '#' # <%# %>
39
- src << ("\n" * code.count("\n"))
40
- else # <%= %>
41
- src << " _buf << (" << code << ").to_s;"
42
- end
43
- end
44
- #rest = $' || input # ruby1.8
45
- rest = pos == 0 ? input : input[pos..-1] # ruby1.9
46
- #src << " _buf << '" << escape_text(rest) << "';"
47
- rest.gsub!(/['\\]/, '\\\\\&')
48
- src << " _buf << '" << rest << "';" unless rest.empty?
49
- src << "\n_buf.to_s\n" # postamble
50
- return src
51
- end
52
-
53
- #def escape_text(text)
54
- # return text.gsub!(/['\\]/, '\\\\\&') || text
55
- #end
56
-
57
- def result(_binding=TOPLEVEL_BINDING)
58
- eval @src, _binding
59
- end
60
-
61
- def evaluate(_context=Object.new)
62
- if _context.is_a?(Hash)
63
- _obj = Object.new
64
- _context.each do |k, v| _obj.instance_variable_set("@#{k}", v) end
65
- _context = _obj
66
- end
67
- _context.instance_eval @src
68
- end
69
-
70
- end
71
-
72
-
73
-
74
- module PI
75
- end
76
-
77
- class PI::TinyEruby
78
-
79
- def initialize(input=nil, options={})
80
- @escape = options[:escape] || 'Erubis::XmlHelper.escape_xml'
81
- @src = convert(input) if input
82
- end
83
-
84
- attr_reader :src
85
-
86
- EMBEDDED_PATTERN = /(^[ \t]*)?<\?rb(\s.*?)\?>([ \t]*\r?\n)?|@(!+)?\{(.*?)\}@/m
87
-
88
- def convert(input)
89
- src = "_buf = '';" # preamble
90
- pos = 0
91
- input.scan(EMBEDDED_PATTERN) do |lspace, stmt, rspace, indicator, expr|
92
- match = Regexp.last_match
93
- len = match.begin(0) - pos
94
- text = input[pos, len]
95
- pos = match.end(0)
96
- #src << " _buf << '" << escape_text(text) << "';"
97
- text.gsub!(/['\\]/, '\\\\\&')
98
- src << " _buf << '" << text << "';" unless text.empty?
99
- if stmt # <?rb ... ?>
100
- if lspace && rspace
101
- src << "#{lspace}#{stmt}#{rspace}"
102
- else
103
- src << " _buf << '" << lspace << "';" if lspace
104
- src << stmt << ";"
105
- src << " _buf << '" << rspace << "';" if rspace
106
- end
107
- else # ${...}, $!{...}
108
- if !indicator
109
- src << " _buf << " << @escape << "(" << expr << ");"
110
- elsif indicator == '!'
111
- src << " _buf << (" << expr << ").to_s;"
112
- end
113
- end
114
- end
115
- #rest = $' || input # ruby1.8
116
- rest = pos == 0 ? input : input[pos..-1] # ruby1.9
117
- #src << " _buf << '" << escape_text(rest) << "';"
118
- rest.gsub!(/['\\]/, '\\\\\&')
119
- src << " _buf << '" << rest << "';" unless rest.empty?
120
- src << "\n_buf.to_s\n" # postamble
121
- return src
122
- end
123
-
124
- #def escape_text(text)
125
- # return text.gsub!(/['\\]/, '\\\\\&') || text
126
- #end
127
-
128
- def result(_binding=TOPLEVEL_BINDING)
129
- eval @src, _binding
130
- end
131
-
132
- def evaluate(_context=Object.new)
133
- if _context.is_a?(Hash)
134
- _obj = Object.new
135
- _context.each do |k, v| _obj.instance_variable_set("@#{k}", v) end
136
- _context = _obj
137
- end
138
- _context.instance_eval @src
139
- end
140
-
141
- end
142
-
143
-
144
- end
@@ -1,22 +0,0 @@
1
- ##
2
- ## $Release: 2.7.0 $
3
- ## copyright(c) 2006-2011 kuwata-lab.com all rights reserved.
4
- ##
5
-
6
- module Kernel
7
-
8
- ##
9
- ## raise NotImplementedError
10
- ##
11
- def not_implemented #:doc:
12
- backtrace = caller()
13
- method_name = (backtrace.shift =~ /`(\w+)'$/) && $1
14
- mesg = "class #{self.class.name} must implement abstract method '#{method_name}()'."
15
- #mesg = "#{self.class.name}##{method_name}() is not implemented."
16
- err = NotImplementedError.new mesg
17
- err.set_backtrace backtrace
18
- raise err
19
- end
20
- private :not_implemented
21
-
22
- end
@@ -1,73 +0,0 @@
1
- ##
2
- ## $Release: 2.7.0 $
3
- ## copyright(c) 2006-2011 kuwata-lab.com all rights reserved.
4
- ##
5
-
6
- ##
7
- ## an implementation of eRuby
8
- ##
9
- ## ex.
10
- ## input = <<'END'
11
- ## <ul>
12
- ## <% for item in @list %>
13
- ## <li><%= item %>
14
- ## <%== item %></li>
15
- ## <% end %>
16
- ## </ul>
17
- ## END
18
- ## list = ['<aaa>', 'b&b', '"ccc"']
19
- ## eruby = Erubis::Eruby.new(input)
20
- ## puts "--- code ---"
21
- ## puts eruby.src
22
- ## puts "--- result ---"
23
- ## context = Erubis::Context.new() # or new(:list=>list)
24
- ## context[:list] = list
25
- ## puts eruby.evaluate(context)
26
- ##
27
- ## result:
28
- ## --- source ---
29
- ## _buf = ''; _buf << '<ul>
30
- ## '; for item in @list
31
- ## _buf << ' <li>'; _buf << ( item ).to_s; _buf << '
32
- ## '; _buf << ' '; _buf << Erubis::XmlHelper.escape_xml( item ); _buf << '</li>
33
- ## '; end
34
- ## _buf << '</ul>
35
- ## ';
36
- ## _buf.to_s
37
- ## --- result ---
38
- ## <ul>
39
- ## <li><aaa>
40
- ## &lt;aaa&gt;</li>
41
- ## <li>b&b
42
- ## b&amp;b</li>
43
- ## <li>"ccc"
44
- ## &quot;ccc&quot;</li>
45
- ## </ul>
46
- ##
47
-
48
-
49
- module Erubis
50
- VERSION = ('$Release: 2.7.0 $' =~ /([.\d]+)/) && $1
51
- end
52
-
53
- require 'erubis/engine'
54
- #require 'erubis/generator'
55
- #require 'erubis/converter'
56
- #require 'erubis/evaluator'
57
- #require 'erubis/error'
58
- #require 'erubis/context'
59
- #requier 'erubis/util'
60
- require 'erubis/helper'
61
- require 'erubis/enhancer'
62
- #require 'erubis/tiny'
63
- require 'erubis/engine/eruby'
64
- #require 'erubis/engine/enhanced' # enhanced eruby engines
65
- #require 'erubis/engine/optimized' # generates optimized ruby code
66
- #require 'erubis/engine/ephp'
67
- #require 'erubis/engine/ec'
68
- #require 'erubis/engine/ejava'
69
- #require 'erubis/engine/escheme'
70
- #require 'erubis/engine/eperl'
71
- #require 'erubis/engine/ejavascript'
72
-
73
- require 'erubis/local-setting'