brakeman 7.1.2 → 8.0.6

data/lib/brakeman/checks/check_execute.rb

@@ -55,6 +55,13 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     first_arg = call.first_arg
     failure = nil
 
+    # All spawn-family methods optionally accept an env hash as the first
+    # argument. Strip it so first_arg always points to the command name.
+    if hash?(first_arg)
+      args.delete_at(1)
+      first_arg = args[1]
+    end
+
     case call.method
     when :popen
       # Normally, if we're in a `popen` call, we only are worried about shell
@@ -99,14 +106,17 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
         break if failure
       end
-    when :system, :exec
-      # Normally, if we're in a `system` or `exec` call, we only are worried
-      # about shell injection when there's a single argument, because comma-
-      # separated arguments are always escaped by Ruby. However, an exception is
-      # when the first two arguments are something like "bash -c" because then
-      # the third argument is effectively the command being run and might be
-      # a malicious executable if it comes (partially or fully) from user input.
-      if dash_c_shell_command?(first_arg, call.second_arg)
+    when :system, :exec, :spawn, :capture2, :capture2e, :capture3,
+         :popen2, :popen2e, :popen3
+      # Comma-separated arguments are passed directly to execve without a
+      # shell, so only the first argument (the command name) needs checking.
+      # Exception: `bash -c <script>` — the script is the injection vector.
+      #
+      # All of these methods accept an optional trailing options hash
+      # (e.g. stdin_data:, chdir:); strip it before checking.
+      args.pop if hash?(args.last) && args.length > 2
+
+      if dash_c_shell_command?(first_arg, args[2])
         failure = include_user_input?(args[3]) ||
                   dangerous_interp?(args[3]) ||
                   dangerous_string_building?(args[3])
@@ -115,16 +125,6 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
                   dangerous_interp?(first_arg) ||
                   dangerous_string_building?(first_arg)
       end
-    when :capture2, :capture2e, :capture3
-      # Open3 capture methods can take a :stdin_data argument which is used as the
-      # the input to the called command so it is not succeptable to command injection.
-      # As such if the last argument is a hash (and therefore execution options) it
-      # should be ignored
-
-      args.pop if hash?(args.last) && args.length > 2
-      failure = include_user_input?(args) ||
-                dangerous_interp?(args) ||
-                dangerous_string_building?(args)
     else
       failure = include_user_input?(args) ||
                 dangerous_interp?(args) ||
@@ -176,6 +176,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
   def include_user_input? exp
     if node_type? exp, :arglist, :dstr, :evstr, :dxstr
       exp.each_sexp do |e|
+        next if shell_escape? e
+
         if res = include_user_input?(e)
           return res
         end
@@ -196,7 +198,7 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
       # Check for input at start of string
       exp[1] == "" and
         node_type? exp[2], :evstr and
-        has_immediate_user_input? exp[2]
+        dangerous? exp[2]
     else
       has_immediate_user_input? exp
     end
@@ -266,6 +268,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
   end
 
   def dangerous_interp? exp
+    return if shell_escape? exp
+
     match = include_interp? exp
     return unless match
     interp = match.match

data/lib/brakeman/checks/check_model_attributes.rb

@@ -12,7 +12,7 @@ class Brakeman::CheckModelAttributes < Brakeman::BaseCheck
 
     #Roll warnings into one warning for all models
     if tracker.options[:collapse_mass_assignment]
-      Brakeman.notify "[Notice] The `collapse_mass_assignment` option has been removed."
+      Brakeman.alert "The `collapse_mass_assignment` option has been removed."
     end
 
     check_models do |name, model|

data/lib/brakeman/checks/check_render.rb

@@ -17,8 +17,7 @@ class Brakeman::CheckRender < Brakeman::BaseCheck
 
     case result[:call].render_type
     when :partial, :template, :action, :file
-      check_for_rce(result) or
-        check_for_dynamic_path(result)
+      check_for_dynamic_path(result)
     when :inline
     when :js
     when :json
@@ -41,8 +40,6 @@ class Brakeman::CheckRender < Brakeman::BaseCheck
         else
           confidence = :high
         end
-      elsif input = include_user_input?(view)
-        confidence = :weak
       else
         return
       end
@@ -62,29 +59,6 @@ class Brakeman::CheckRender < Brakeman::BaseCheck
     end
   end
 
-  def check_for_rce result
-    return unless version_between? "0.0.0", "3.2.22" or
-                  version_between? "4.0.0", "4.1.14" or
-                  version_between? "4.2.0", "4.2.5"
-
-
-    view = result[:call][2]
-    if sexp? view and not duplicate? result
-      if params? view
-        add_result result
-        return if safe_param? view
-
-        warn :result => result,
-          :warning_type => "Remote Code Execution",
-          :warning_code => :dynamic_render_path_rce,
-          :message => msg("Passing query parameters to ", msg_code("render"), " is vulnerable in ", msg_version(rails_version), " ", msg_cve("CVE-2016-0752")),
-          :user_input => view,
-          :confidence => :high,
-          :cwe_id => [22]
-      end
-    end
-  end
-
   def safe_param? exp
     if params? exp and call? exp
       method_name = exp.method

data/lib/brakeman/checks/check_render_rce.rb

@@ -0,0 +1,43 @@
+require 'brakeman/checks/check_render'
+
+class Brakeman::CheckRenderRCE < Brakeman::CheckRender
+  Brakeman::Checks.add self
+
+  @description = "Finds calls to render that might be vulnerable to CVE-2016-0752"
+
+  def run_check
+    tracker.find_call(:target => nil, :method => :render).each do |result|
+      process_render_result result
+    end
+  end
+
+  def process_render_result result
+    return unless node_type? result[:call], :render
+
+    case result[:call].render_type
+    when :partial, :template, :action, :file
+      check_for_rce(result)
+    end
+  end
+
+  def check_for_rce result
+    return unless version_between? "0.0.0", "3.2.22" or
+                  version_between? "4.0.0", "4.1.14" or
+                  version_between? "4.2.0", "4.2.5"
+
+    view = result[:call][2]
+    if sexp? view and not duplicate? result
+      if params? view and not safe_param? view
+        add_result result
+
+        warn :result => result,
+          :warning_type => "Remote Code Execution",
+          :warning_code => :dynamic_render_path_rce,
+          :message => msg("Passing query parameters to ", msg_code("render"), " is vulnerable in ", msg_version(rails_version), " ", msg_cve("CVE-2016-0752")),
+          :user_input => view,
+          :confidence => :high,
+          :cwe_id => [22]
+      end
+    end
+  end
+end

data/lib/brakeman/checks/check_session_settings.rb

@@ -120,7 +120,7 @@ class Brakeman::CheckSessionSettings < Brakeman::BaseCheck
       begin
         secrets = YAML.safe_load yaml, aliases: true
       rescue Psych::SyntaxError, RuntimeError => e
-        Brakeman.notify "[Notice] #{self.class}: Unable to parse `#{secrets_file}`"
+        Brakeman.alert "#{self.class}: Unable to parse `#{secrets_file}`"
         Brakeman.debug "Failed to parse #{secrets_file}: #{e.inspect}"
         return
       end

data/lib/brakeman/checks/check_sql.rb

@@ -311,7 +311,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     end
 
     if request_value? arg
-      unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash, :symbolize_keys].include? arg.method
+      unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash, :symbolize_keys, :compact, :compact_blank].include? arg.method
         # Model.where(params[:where])
         arg
       end
@@ -600,7 +600,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     :sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
     :sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
     :to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
-    :where_values_hash, :foreign_key, :uuid, :escape, :escape_string
+    :where_values_hash, :foreign_key, :uuid, :escape, :escape_string,
+    :polymorphic_name
   ]
 
   def ignore_methods_in_sql
@@ -644,7 +645,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
       locale_call? exp
   end
 
-  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
+  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name, :quote_schema_name]
 
   def quote_call? exp
     if call? exp.target

data/lib/brakeman/checks.rb

@@ -121,37 +121,43 @@ class Brakeman::Checks
     parallel = tracker.options[:parallel_checks]
     error_mutex = Mutex.new
 
-    checks.each do |c|
-      check_name = get_check_name c
-      Brakeman.notify " - #{check_name}"
+    message = if parallel
+      "Running #{checks.length} checks in parallel"
+    else
+      "Running #{checks.length} checks"
+    end
 
-      if parallel
-        threads << Thread.new do
-          self.run_a_check(c, error_mutex, tracker)
+    Brakeman.process_step(message) do
+      checks.each do |c|
+        check_name = get_check_name c
+        Brakeman.debug " - #{check_name}"
+
+        if parallel
+          threads << Thread.new do
+            self.run_a_check(c, error_mutex, tracker)
+          end
+        else
+          results << self.run_a_check(c, error_mutex, tracker)
         end
-      else
-        results << self.run_a_check(c, error_mutex, tracker)
-      end
-
-      #Maintain list of which checks were run
-      #mainly for reporting purposes
-      check_runner.checks_run << check_name[5..-1]
-    end
 
-    threads.each { |t| t.join }
+        #Maintain list of which checks were run
+        #mainly for reporting purposes
+        check_runner.checks_run << check_name[5..-1]
+      end
 
-    Brakeman.notify "Checks finished, collecting results..."
+      threads.each { |t| t.join }
 
-    if parallel
-      threads.each do |thread|
-        thread.value.each do |warning|
-          check_runner.add_warning warning
+      if parallel
+        threads.each do |thread|
+          thread.value.each do |warning|
+            check_runner.add_warning warning
+          end
         end
-      end
-    else
-      results.each do |warnings|
-        warnings.each do |warning|
-          check_runner.add_warning warning
+      else
+        results.each do |warnings|
+          warnings.each do |warning|
+            check_runner.add_warning warning
+          end
         end
       end
     end

data/lib/brakeman/commandline.rb

@@ -31,15 +31,22 @@ module Brakeman
         set_interrupt_handler options
         early_exit_options options
         set_options options, default_app_path
-        check_latest if options[:ensure_latest]
+        check_latest(options[:ensure_latest]) if options[:ensure_latest]
         run_report options
+
+        quit
       end
 
       # Check for the latest version.
       #
-      # If the latest version is newer, quit with a message.
-      def check_latest
-        if error = Brakeman.ensure_latest
+      # If the latest version is newer than the current version
+      # and age, exit.
+      def check_latest(days_old = 0)
+        if days_old == true
+          days_old = 0
+        end
+
+        if error = Brakeman.ensure_latest(days_old:)
           quit Brakeman::Not_Latest_Version_Exit_Code, error
         end
       end
@@ -54,11 +61,13 @@ module Brakeman
             f.puts JSON.pretty_generate(vulns)
           end
 
-          Brakeman.notify "Comparison saved in '#{options[:comparison_output_file]}'"
+          Brakeman.announce "Comparison saved in '#{options[:comparison_output_file]}'"
         else
           puts JSON.pretty_generate(vulns)
         end
 
+        Brakeman.cleanup(false)
+
         if options[:exit_on_warn] && vulns[:new].count > 0
           quit Brakeman::Warnings_Found_Exit_Code
         end
@@ -117,6 +126,7 @@ module Brakeman
       # Override this method for different behavior.
       def quit exit_code = 0, message = nil
         warn message if message
+        Brakeman.cleanup
         exit exit_code
       end
 
@@ -186,6 +196,8 @@ module Brakeman
             warn caller
           end
 
+          Brakeman.cleanup
+
           exit!
         end
       end

data/lib/brakeman/file_parser.rb

@@ -13,9 +13,9 @@ module Brakeman
       if @use_prism
         begin
           require 'prism'
-          Brakeman.debug '[Notice] Using Prism parser'
+          Brakeman.debug 'Using Prism parser'
         rescue LoadError => e
-          Brakeman.debug "[Notice] Asked to use Prism, but failed to load: #{e}"
+          Brakeman.debug "Asked to use Prism, but failed to load: #{e}"
           @use_prism = false
         end
       end
@@ -46,6 +46,7 @@ module Brakeman
       #
       # Note this method no longer uses read_files
       @file_list, new_errors = Parallel.map(list, parallel_options) do |file_name|
+        Brakeman.logger.spin
         file_path = @app_tree.file_path(file_name)
         contents = file_path.read
 

data/lib/brakeman/logger.rb

@@ -0,0 +1,265 @@
+module Brakeman
+  module Logger
+    def self.get_logger options, dest = $stderr
+      case
+      when options[:debug]
+        Debug.new(options, dest)
+      when options[:quiet]
+        Quiet.new(options, dest)
+      when options[:report_progress] == false
+        Plain.new(options, dest)
+      when dest.tty?
+        Console.new(options, dest)
+      else
+        Plain.new(options, dest)
+      end
+    end
+
+    class Base
+      def initialize(options, log_destination = $stderr)
+        @dest = log_destination
+        @show_timing = options[:debug] || options[:show_timing]
+      end
+
+      # Output a message to the log.
+      # If newline is `false`, does not output a newline after message.
+      def log(message, newline: true)
+        if newline
+          @dest.puts message
+        else
+          @dest.write message
+        end
+      end
+
+      # Notify about important information - use sparingly
+      def announce(message); end
+
+      # Notify regarding errors - use sparingly
+      def alert(message); end
+
+      # Output debug information
+      def debug(message); end
+
+      # Wraps a step in the scanning process
+      def context(description, &)
+        yield self
+      end
+
+      # Wraps a substep (e.g. processing one file)
+      def single_context(description, &)
+        yield
+      end
+
+      # Update progress towards a known total
+      def update_progress(current, total, type = 'files'); end
+
+      # Show a spinner
+      def spin; end
+
+      # Called on exit
+      def cleanup(newline = true); end
+
+      def show_timing? = @show_timing
+
+      # Use ANSI codes to color a string
+      def color(message, *)
+        if @highline
+          @highline.color(message, *)
+        else
+          message
+        end
+      end
+
+      def color?
+        @highline and @highline.use_color?
+      end
+
+      private
+
+      def load_highline(output_color)
+        if @dest.tty? or output_color == :force
+          Brakeman.load_brakeman_dependency 'highline'
+          @highline = HighLine.new
+          @highline.use_color = !!output_color
+        else
+          @highline = nil
+        end
+      end
+    end
+
+    class Plain < Base
+      def initialize(options, *)
+        super
+
+        load_highline(options[:output_color])
+      end
+
+      def announce(message)
+        log color(message, :bold, :green)
+      end
+
+      def alert(message)
+        log color(message, :red)
+      end
+
+      def context(description, &)
+        log "#{color(description, :green)}..."
+
+        if show_timing?
+          time_step(description, &)
+        else
+          yield
+        end
+      end
+
+      def time_step(description, &)
+        start_t = Time.now
+        yield
+        duration = Time.now - start_t
+
+        log color(("Completed #{description.to_s.downcase} in %0.2fs" % duration), :gray)
+      end
+    end
+
+    class Quiet < Base
+      def initialize(*)
+        super
+      end
+    end
+
+    class Debug < Plain
+      def debug(message)
+        log color(message, :gray)
+      end
+
+      def context(description, &)
+        log "#{description}..."
+
+        time_step(description, &)
+      end
+
+      def single_context(description, &)
+        debug "Processing #{description}"
+
+        if show_timing?
+          # Even in debug, only show timing for each file if asked
+          time_step(description, &)
+        else
+          yield
+        end
+      end
+    end
+
+    class Console < Base
+      attr_reader :prefix
+
+      def initialize(options, *)
+        super
+
+        load_highline(options[:output_color])
+        require 'reline'
+        require 'reline/io/ansi'
+
+        @prefix = ''
+        @post_fix_pos = 0
+        @reline = Reline::ANSI.new
+        @reline.output = @dest
+        @report_progress = options[:report_progress]
+        @spinner = ["⣀", "⣄", "⣤", "⣦", "⣶", "⣷", "⣿"]
+        @percenter = ["⣀", "⣤", "⣶", "⣿"]
+        @spindex = 0
+        @last_spin = Time.now
+        @reline.hide_cursor
+      end
+
+      def announce message
+        clear_line
+        log color(message, :bold, :green)
+        rewrite_prefix
+      end
+
+      def alert message
+        clear_line
+        log color(message, :red)
+        rewrite_prefix
+      end
+
+      def context(description, &)
+        write_prefix description
+
+        time_step(description, &)
+      ensure
+        clear_prefix
+      end
+
+      def time_step(description, &)
+        if show_timing?
+          start_t = Time.now
+          yield
+          duration = Time.now - start_t
+
+          write_after color(('%0.2fs' % duration), :gray)
+          log ''
+        else
+          yield
+        end
+      end
+
+      def update_progress current, total, type = 'files'
+        percent = ((current / total.to_f) * 100).to_i
+        tenths = [(percent / 10), 0].max
+
+        lead = color(@percenter[percent % 10 / 3], :bold, :red)
+        done_blocks = color("⣿" * tenths, :red)
+        remaining = color("⣀" * (9 - tenths), :gray)
+        write_after "#{done_blocks}#{lead}#{remaining}"
+      end
+
+      def write_prefix pref
+        set_prefix pref
+        rewrite_prefix
+      end
+
+      # If an alert was written, redo prefix on next line
+      def rewrite_prefix
+        log(@prefix, newline: false)
+        @reline.erase_after_cursor
+      end
+
+      def write_after message
+        @reline.move_cursor_column(@post_fix_pos)
+        log(message, newline: false)
+        @reline.erase_after_cursor
+      end
+
+      def set_prefix message
+        @prefix = "#{color('»', :bold, :cyan)} #{color(message, :green)}"
+        @post_fix_pos = HighLine::Wrapper.actual_length(@prefix) + 1
+      end
+
+      def clear_prefix
+        @prefix = ''
+        @post_fix_pos = 0
+        clear_line
+      end
+
+      def clear_line
+        @reline.move_cursor_column(0)
+        @reline.erase_after_cursor
+      end
+
+      def spin
+        return unless (Time.now - @last_spin) > 0.2
+
+        write_after color(@spinner[@spindex], :bold, :red)
+        @spindex = (@spindex + 1) % @spinner.length
+        @last_spin = Time.now
+      end
+
+      def cleanup(newline = true)
+        @reline.show_cursor
+        log('') if newline
+      end
+    end
+  end
+end

data/lib/brakeman/options.rb

@@ -63,8 +63,12 @@ module Brakeman::Options
           options[:exit_on_error] = exit_on_error
         end
 
-        opts.on "--ensure-latest", "Fail when Brakeman is outdated" do
-          options[:ensure_latest] = true
+        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days." do |days|
+          if days and not (1..15).include? days
+            raise OptionParser::InvalidArgument
+          end
+
+          options[:ensure_latest] = days || true
         end
 
         opts.on "--ensure-ignore-notes", "Fail when an ignored warnings does not include a note" do
@@ -131,7 +135,6 @@ module Brakeman::Options
 
         opts.on "--faster", "Faster, but less accurate scan" do
           options[:ignore_ifs] = true
-          options[:skip_libs] = true
           options[:disable_constant_tracking] = true
         end
 
@@ -143,10 +146,6 @@ module Brakeman::Options
           options[:ignore_attr_protected] = true
         end
 
-        opts.on "--[no-]index-libs", "Add libraries to call index (Default)" do |index|
-          options[:index_libs] = index
-        end
-
         opts.on "--interprocedural", "Process method calls to known methods" do
           options[:interprocedural] = true
         end
@@ -212,10 +211,6 @@ module Brakeman::Options
           options[:skip_vendor] = skip
         end
 
-        opts.on "--skip-libs", "Skip processing lib directory" do
-          options[:skip_libs] = true
-        end
-
         opts.on "--add-libs-path path1,path2,etc", Array, "An application relative lib directory (ex. app/mailers) to process" do |paths|
           options[:additional_libs_path] ||= Set.new
           options[:additional_libs_path].merge paths