brakeman 7.1.2 → 8.0.6

data/lib/brakeman/parsers/rails_erubi.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+# Copied almost verbatim from Rails
+# https://github.com/rails/rails/blob/5359cf8a5b093b04170e884ee8da5a1e076b8a0d/actionview/lib/action_view/template/handlers/erb/erubi.rb#L9
+
+Brakeman.load_brakeman_dependency "erubi"
+
+module Brakeman
+  class Erubi < ::Erubi::Engine
+    # :nodoc: all
+    def initialize(input, properties = {})
+      @newline_pending = 0
+
+      # Dup properties so that we don't modify argument
+      properties = Hash[properties]
+
+      properties[:bufvar]     ||= "@output_buffer"
+      properties[:preamble]   ||= ""
+      properties[:postamble]  ||= "#{properties[:bufvar]}"
+
+      # Tell Erubi whether the template will be compiled with `frozen_string_literal: true`
+      # properties[:freeze_template_literals] = !Template.frozen_string_literal
+      properties[:freeze_template_literals] = false
+
+      properties[:escapefunc] = ""
+
+      super
+    end
+
+  private
+    def add_text(text)
+      return if text.empty?
+
+      if text == "\n"
+        @newline_pending += 1
+      else
+        with_buffer do
+          src << ".safe_append='"
+          src << "\n" * @newline_pending if @newline_pending > 0
+          src << text.gsub(/['\\]/, '\\\\\&') << @text_end
+        end
+        @newline_pending = 0
+      end
+    end
+
+    BLOCK_EXPR = /((\s|\))do|\{)(\s*\|[^|]*\|)?\s*\Z/
+
+    def add_expression(indicator, code)
+      flush_newline_if_pending(src)
+
+      with_buffer do
+        if (indicator == "==") || @escape
+          src << ".safe_expr_append="
+        else
+          src << ".append="
+        end
+
+        if BLOCK_EXPR.match?(code)
+          src << " " << code
+        else
+          src << "(" << code << ")"
+        end
+      end
+    end
+
+    def add_code(code)
+      flush_newline_if_pending(src)
+      super
+    end
+
+    def add_postamble(_)
+      flush_newline_if_pending(src)
+      super
+    end
+
+    def flush_newline_if_pending(src)
+      if @newline_pending > 0
+        with_buffer { src << ".safe_append='#{"\n" * @newline_pending}" << @text_end }
+        @newline_pending = 0
+      end
+    end
+  end
+end

data/lib/brakeman/parsers/template_parser.rb

@@ -21,7 +21,7 @@ module Brakeman
       begin
         src = case type
               when :erb
-                type = :erubis if erubis?
+                type = :erubi if erubi?
                 parse_erb path, text
               when :haml
                 type = :haml6 if haml6?
@@ -46,17 +46,9 @@ module Brakeman
     end
 
     def parse_erb path, text
-      if tracker.config.escape_html?
-        if tracker.options[:rails3]
-          require 'brakeman/parsers/rails3_erubis'
-          Brakeman::Rails3Erubis.new(text, :filename => path).src
-        else
-          require 'brakeman/parsers/rails2_xss_plugin_erubis'
-          Brakeman::Rails2XSSPluginErubis.new(text, :filename => path).src
-        end
-      elsif tracker.config.erubis?
-        require 'brakeman/parsers/rails2_erubis'
-        Brakeman::ScannerErubis.new(text, :filename => path).src
+      if erubi?
+        require 'brakeman/parsers/rails_erubi'
+        Brakeman::Erubi.new(text, :filename => path).src
       else
         require 'erb'
         src = if ERB.instance_method(:initialize).parameters.assoc(:key) # Ruby 2.6+
@@ -69,9 +61,9 @@ module Brakeman
       end
     end
 
-    def erubis?
+    def erubi?
       tracker.config.escape_html? or
-        tracker.config.erubis?
+        tracker.config.erubi?
     end
 
     def parse_haml path, text
@@ -148,7 +140,7 @@ module Brakeman
       fp = Brakeman::FileParser.new(tracker.app_tree, tracker.options[:parser_timeout])
       tp = self.new(tracker, fp)
       src = tp.parse_erb '_inline_', text
-      type = tp.erubis? ? :erubis : :erb
+      type = tp.erubi? ? :erubi : :erb
 
       return type, fp.parse_ruby(src, "_inline_")
     end

data/lib/brakeman/processor.rb

@@ -65,8 +65,8 @@ module Brakeman
         result = HamlTemplateProcessor.new(@tracker, name, called_from, file_name).process src
       when :haml6
         result = Haml6TemplateProcessor.new(@tracker, name, called_from, file_name).process src
-      when :erubis
-        result = ErubisTemplateProcessor.new(@tracker, name, called_from, file_name).process src
+      when :erubi
+        result = ErubiTemplateProcessor.new(@tracker, name, called_from, file_name).process src
       when :slim
         result = SlimTemplateProcessor.new(@tracker, name, called_from, file_name).process src
       else

data/lib/brakeman/processors/base_processor.rb

@@ -258,12 +258,19 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     #Look for "type" of render in options hash
     #For example, render :file => "blah"
     if hash? last_arg
-      hash_iterate(last_arg) do |key, val|
-        if symbol? key and types_in_hash.include? key.value
-          type = key.value
-          value = val
-        else  
-          rest << key << val
+      if type
+        #The render type was already determined by a positional argument, so a
+        #key in the options hash that happens to match a render type name (e.g.
+        #`text:`) is a local passed to the partial/action, not a type directive.
+        rest = last_arg
+      else
+        hash_iterate(last_arg) do |key, val|
+          if symbol? key and types_in_hash.include? key.value
+            type = key.value
+            value = val
+          else
+            rest << key << val
+          end
         end
       end
     end

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -146,7 +146,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
     filter = tracker.find_method name, @current_class
 
     if filter.nil?
-      Brakeman.debug "[Notice] Could not find filter #{name}"
+      Brakeman.debug "Could not find filter #{name}"
       return
     end
 

data/lib/brakeman/processors/controller_processor.rb

@@ -30,13 +30,13 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
     #But if not inside a controller already, then the class may include
     #a real controller, so we can't take this shortcut.
     if @current_class and @current_class.name.to_s.end_with? "Controller"
-      Brakeman.debug "[Notice] Treating inner class as library: #{name}"
+      Brakeman.debug "Treating inner class as library: #{name}"
       Brakeman::LibraryProcessor.new(@tracker).process_library exp, @current_file
       return exp
     end
 
     if not name.to_s.end_with? "Controller"
-      Brakeman.debug "[Notice] Adding noncontroller as library: #{name}"
+      Brakeman.debug "Adding noncontroller as library: #{name}"
       #Set the class to be a module in order to get the right namespacing.
       #Add class to libraries, in case it is needed later (e.g. it's used
       #as a parent class for a controller.)
@@ -124,7 +124,7 @@ class Brakeman::ControllerProcessor < Brakeman::BaseProcessor
             if @app_tree.layout_exists?(name)
               @current_class.layout = "layouts/#{name}"
             else
-              Brakeman.debug "[Notice] Layout not found: #{name}"
+              Brakeman.debug "Layout not found: #{name}"
             end
           elsif node_type? last_arg, :nil, :false
             #layout :false or layout nil

data/lib/brakeman/processors/{erubis_template_processor.rb → erubi_template_procesor.rb}

@@ -1,7 +1,7 @@
 require 'brakeman/processors/template_processor'
 
-#Processes ERB templates using Erubis instead of erb.
-class Brakeman::ErubisTemplateProcessor < Brakeman::TemplateProcessor
+#Processes ERB templates using Erubi instead of erb.
+class Brakeman::ErubiTemplateProcessor < Brakeman::TemplateProcessor
 
   #s(:call, TARGET, :method, ARGS)
   def process_call exp
@@ -14,7 +14,7 @@ class Brakeman::ErubisTemplateProcessor < Brakeman::TemplateProcessor
     exp.arglist = process exp.arglist
     method = exp.method
 
-    #_buf is the default output variable for Erubis
+    #_buf is the default output variable for Erubi
     if node_type?(target, :lvar, :ivar) and (target.value == :_buf or target.value == :@output_buffer)
       if method == :<< or method == :safe_concat
 

data/lib/brakeman/processors/gem_processor.rb

@@ -6,7 +6,7 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
   def initialize *args
     super
     @gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
-    @ruby_version = /^\s+ruby (\d\.\d.\d+)/
+    @ruby_version = /^\s+ruby (\d+\.\d+\.\d+)/
   end
 
   def process_gems gem_files

data/lib/brakeman/processors/haml_template_processor.rb

@@ -186,6 +186,8 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
 
   def raw? exp
     call? exp and
-      exp.method == :raw
+      exp.target.nil? and
+      exp.method == :raw and
+      exp.first_arg
   end
 end

data/lib/brakeman/processors/lib/rails2_config_processor.rb

@@ -33,14 +33,15 @@ class Brakeman::Rails2ConfigProcessor < Brakeman::BasicProcessor
     process res
   end
 
-  #Check if config is set to use Erubis
+  # Check if config is set to use Erubis
+  # but because it's 2026 we're going to use Erubi
   def process_call exp
     target = exp.target
     target = process target if sexp? target
 
     if exp.method == :gem and exp.first_arg.value == "erubis"
-      Brakeman.notify "[Notice] Using Erubis for ERB templates"
-      @tracker.config.erubis = true
+      Brakeman.debug "[Notice] Using Erubi for ERB templates"
+      @tracker.config.erubi = true
     end
 
     exp

data/lib/brakeman/processors/lib/rails2_route_processor.rb

@@ -131,7 +131,7 @@ class Brakeman::Rails2RoutesProcessor < Brakeman::BasicProcessor
       when :except
         process_option_except value
       else
-        Brakeman.notify "[Notice] Unhandled resource option, please report: #{option}"
+        Brakeman.alert "Unhandled resource option, please report: #{option}"
       end
     end
   end

data/lib/brakeman/processors/lib/rails3_config_processor.rb

@@ -17,6 +17,7 @@ require 'brakeman/processors/lib/basic_processor'
 #Values for tracker.config.rails will still be Sexps.
 class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
   RAILS_CONFIG = Sexp.new(:call, nil, :config)
+  RAILS_APPLICATION = Sexp.new(:colon2, s(:const, :Rails), :Application)
 
   def initialize *args
     super
@@ -48,7 +49,7 @@ class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
 
   #Look for class Application < Rails::Application
   def process_class exp
-    if exp.class_name == :Application
+    if application_class? exp
       @inside_config = true
       process_all exp.body if sexp? exp.body
       @inside_config = false
@@ -57,6 +58,14 @@ class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
     exp
   end
 
+  def application_class? exp
+    return unless node_type? exp, :class
+
+    exp.class_name == :Application or
+    (node_type? exp.class_name, :colon2 and exp.class_name.rhs == :Application) or
+    (exp.parent_name == RAILS_APPLICATION)
+  end
+
   #Look for configuration settings that
   #are just a call like
   #

data/lib/brakeman/processors/lib/render_helper.rb

@@ -19,7 +19,9 @@ module Brakeman::RenderHelper
       end
     when :default
       begin
-        process_template template_name, exp[3], nil, exp.line
+        # exp[2] is either the action name (from controller) or :default when no explicit arg
+        name_arg = (exp[2].nil? || exp[2] == :default) ? nil : exp[2]
+        process_template template_name(name_arg), exp[3], nil, exp.line
       rescue ArgumentError
         Brakeman.debug "Problem processing render: #{exp}"
       end
@@ -98,7 +100,7 @@ module Brakeman::RenderHelper
     name = name.to_s.gsub(/^\//, "")
     template = @tracker.templates[name.to_sym]
     unless template
-      Brakeman.debug "[Notice] No such template: #{name}"
+      Brakeman.debug "No such template: #{name}"
       return
     end
 

data/lib/brakeman/processors/lib/render_path.rb

@@ -36,7 +36,7 @@ module Brakeman
           file: template.file,
         }
       else
-        Brakeman.debug "[Notice] No render path to add template information"
+        Brakeman.debug "No render path to add template information"
       end
     end
 

data/lib/brakeman/processors/model_processor.rb

@@ -27,7 +27,7 @@ class Brakeman::ModelProcessor < Brakeman::BaseProcessor
 
     #If inside an inner class we treat it as a library.
     if @current_class
-      Brakeman.debug "[Notice] Treating inner class as library: #{name}"
+      Brakeman.debug "Treating inner class as library: #{name}"
       Brakeman::LibraryProcessor.new(@tracker).process_library exp, @current_file
       return exp
     end

data/lib/brakeman/report/ignore/config.rb

@@ -107,7 +107,7 @@ module Brakeman
           raise e, "\nError[#{e.class}] while reading brakeman ignore file: #{file}\n"
         end
       else
-        Brakeman.notify "[Notice] Could not find ignore configuration in #{file}"
+        Brakeman.alert "Could not find ignore configuration in #{file} (no file)"
         @already_ignored = []
       end
 

data/lib/brakeman/scanner.rb

@@ -31,8 +31,6 @@ class Brakeman::Scanner
     end
 
     @processor = processor || Brakeman::Processor.new(@app_tree, options)
-    @show_timing = tracker.options[:debug] || tracker.options[:show_timing]
-    @per_file_timing = tracker.options[:debug] && tracker.options[:show_timing]
   end
 
   #Returns the Tracker generated from the scan
@@ -44,32 +42,12 @@ class Brakeman::Scanner
     tracker.file_cache
   end
 
-  def process_step description
-    Brakeman.notify "#{description}...".ljust(40)
-
-    if @show_timing
-      start_t = Time.now
-      yield
-      duration = Time.now - start_t
-
-      Brakeman.notify "(#{description}) Duration: #{duration} seconds"
-    else
-      yield
-    end
+  def process_step(description, &)
+    Brakeman.process_step(description, &)
   end
 
-  def process_step_file description
-    if @per_file_timing
-      Brakeman.notify "Processing #{description}"
-
-      start_t = Time.now
-      yield
-      duration = Time.now - start_t
-
-      Brakeman.notify "(#{description}) Duration: #{duration} seconds"
-    else
-      yield
-    end
+  def process_step_file(description, &)
+    Brakeman.logger.single_context(description, &)
   end
 
   #Process everything in the Rails application
@@ -111,7 +89,7 @@ class Brakeman::Scanner
       process_initializers
     end
 
-    process_step 'Processing libs' do
+    process_step 'Processing libraries' do
       process_libs
     end
 
@@ -123,7 +101,7 @@ class Brakeman::Scanner
       process_templates
     end
 
-    process_step 'Processing data flow in templates' do
+    process_step 'Processing data flow' do
       process_template_data_flows
     end
 
@@ -135,11 +113,11 @@ class Brakeman::Scanner
       process_controllers
     end
 
-    process_step 'Processing data flow in controllers' do
+    process_step 'Processing data flow' do
       process_controller_data_flows
     end
 
-    process_step 'Indexing call sites' do
+    process_step 'Indexing method calls' do
       index_call_sites
     end
 
@@ -154,6 +132,7 @@ class Brakeman::Scanner
     template_parser = Brakeman::TemplateParser.new(tracker, fp)
 
     fp.read_files(template_paths) do |path, contents|
+      Brakeman.logger.spin
       template_parser.parse_template(path, contents)
     end
 
@@ -167,6 +146,8 @@ class Brakeman::Scanner
     detector = Brakeman::FileTypeDetector.new
 
     astfiles.each do |file|
+      Brakeman.logger.spin
+
       if file.is_a? Brakeman::TemplateParser::TemplateFile
         file_cache.add_file file, :template
       else
@@ -202,12 +183,18 @@ class Brakeman::Scanner
       options[:rails3] or options[:escape_html]
 
       tracker.config.escape_html = true
-      Brakeman.notify "[Notice] Escaping HTML by default"
+      Brakeman.debug 'Escaping HTML by default'
     end
 
     if @app_tree.exists? ".ruby-version"
-      if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/]
-        tracker.config.set_ruby_version version, @app_tree.file_path(".ruby-version"), 1
+      contents = @app_tree.file_path(".ruby-version").read
+      # Skip alternative Ruby implementations — the EOL dates Brakeman knows
+      # about are MRI's, so a `.ruby-version` of "jruby-10.0.2.0" should not
+      # be parsed as MRI 0.0.2 / 10.0.2.
+      unless contents =~ /\A\s*(jruby|truffleruby|rbx|rubinius|mruby)\b/i
+        if version = contents[/(\d+\.\d+\.\d+)/]
+          tracker.config.set_ruby_version version, @app_tree.file_path(".ruby-version"), 1
+        end
       end
     end
 
@@ -222,7 +209,7 @@ class Brakeman::Scanner
     end
 
   rescue => e
-    Brakeman.notify "[Notice] Error while processing #{path}"
+    Brakeman.alert "Error while processing #{path}"
     tracker.error e.exception(e.message + "\nwhile processing #{path}"), e.backtrace
   end
 
@@ -264,7 +251,7 @@ class Brakeman::Scanner
       @processor.process_gems gem_files
     end
   rescue => e
-    Brakeman.notify "[Notice] Error while processing Gemfile."
+    Brakeman.alert 'Error while processing Gemfile'
     tracker.error e.exception(e.message + "\nWhile processing Gemfile"), e.backtrace
   end
 
@@ -273,16 +260,16 @@ class Brakeman::Scanner
     unless tracker.options[:rails3] or tracker.options[:rails4]
       if @app_tree.exists?("script/rails")
         tracker.options[:rails3] = true
-        Brakeman.notify "[Notice] Detected Rails 3 application"
+        Brakeman.debug 'Detected Rails 3 application'
       elsif @app_tree.exists?("app/channels")
         tracker.options[:rails3] = true
         tracker.options[:rails4] = true
         tracker.options[:rails5] = true
-        Brakeman.notify "[Notice] Detected Rails 5 application"
+        Brakeman.debug 'Detected Rails 5 application'
       elsif not @app_tree.exists?("script")
         tracker.options[:rails3] = true
         tracker.options[:rails4] = true
-        Brakeman.notify "[Notice] Detected Rails 4 application"
+        Brakeman.debug 'Detected Rails 4 application'
       end
     end
   end
@@ -303,15 +290,10 @@ class Brakeman::Scanner
     @processor.process_initializer(init.path, init.ast)
   end
 
-  #Process all .rb in lib/
-  #
-  #Adds parsed information to tracker.libs.
+  # Adds parsed information to tracker.libs.
+  # This is a catch-all for any Ruby files that weren't determined
+  # to be a specific type of file (like a controller).
   def process_libs
-    if options[:skip_libs]
-      Brakeman.notify '[Skipping]'
-      return
-    end
-
     libs = file_cache.libs.sort_by { |path, _| path }
 
     track_progress libs do |path, lib|
@@ -335,11 +317,11 @@ class Brakeman::Scanner
       if routes_sexp = parse_ruby_file(file)
         @processor.process_routes routes_sexp
       else
-        Brakeman.notify "[Notice] Error while processing routes - assuming all public controller methods are actions."
+        Brakeman.alert 'Error while processing routes - assuming all public controller methods are actions.'
         options[:assume_all_routes] = true
       end
     else
-      Brakeman.notify "[Notice] No route information found"
+      Brakeman.alert 'No route information found'
     end
   end
 
@@ -427,15 +409,15 @@ class Brakeman::Scanner
     total = list.length
     current = 0
     list.each do |item|
-      report_progress current, total, type
+      report_progress current, total
       current += 1
       yield item
     end
   end
 
-  def report_progress(current, total, type = "files")
+  def report_progress(current, total)
     return unless @options[:report_progress]
-    $stderr.print " #{current}/#{total} #{type} processed\r"
+    Brakeman.logger.update_progress(current, total)
   end
 
   def index_call_sites

data/lib/brakeman/tracker/collection.rb

@@ -55,13 +55,23 @@ module Brakeman
       if src.node_type == :defs
         @class_methods[name] = meth_info
 
-        # TODO fix this weirdness
-        name = :"#{src[1]}.#{name}"
+        name = :"#{method_definition_receiver(src[1])}.#{name}"
       end
 
       @methods[visibility][name] = meth_info
     end
 
+    def method_definition_receiver(receiver)
+      return receiver if receiver.is_a?(Symbol)
+
+      case receiver.sexp_type
+      when :self
+        "self"
+      else
+        receiver[1].to_s
+      end
+    end
+
     def each_method
       @methods.each do |_vis, meths|
         meths.each do |name, info|