brakeman 7.1.2 → 8.0.6

data/lib/brakeman/tracker/config.rb

@@ -5,7 +5,7 @@ module Brakeman
     include Util
 
     attr_reader :gems, :rails, :ruby_version, :tracker
-    attr_writer :erubis, :escape_html
+    attr_writer :erubi, :escape_html
 
     def initialize tracker
       @tracker = tracker
@@ -13,7 +13,7 @@ module Brakeman
       @gems = {}
       @settings = {}
       @escape_html = nil
-      @erubis = nil
+      @erubi = nil
       @ruby_version = nil
       @rails_version = nil
     end
@@ -28,8 +28,8 @@ module Brakeman
       false
     end
 
-    def erubis?
-      @erubis
+    def erubi?
+      @erubi
     end
 
     def escape_html?
@@ -88,29 +88,29 @@ module Brakeman
         if tracker.options[:rails3].nil? and tracker.options[:rails4].nil?
           if @rails_version.start_with? "3"
             tracker.options[:rails3] = true
-            Brakeman.notify "[Notice] Detected Rails 3 application"
+            notify_version 3
           elsif @rails_version.start_with? "4"
             tracker.options[:rails3] = true
             tracker.options[:rails4] = true
-            Brakeman.notify "[Notice] Detected Rails 4 application"
+            notify_version 4
           elsif @rails_version.start_with? "5"
             tracker.options[:rails3] = true
             tracker.options[:rails4] = true
             tracker.options[:rails5] = true
-            Brakeman.notify "[Notice] Detected Rails 5 application"
+            notify_version 5
           elsif @rails_version.start_with? "6"
             tracker.options[:rails3] = true
             tracker.options[:rails4] = true
             tracker.options[:rails5] = true
             tracker.options[:rails6] = true
-            Brakeman.notify "[Notice] Detected Rails 6 application"
+            notify_version 6
           elsif @rails_version.start_with? "7"
             tracker.options[:rails3] = true
             tracker.options[:rails4] = true
             tracker.options[:rails5] = true
             tracker.options[:rails6] = true
             tracker.options[:rails7] = true
-            Brakeman.notify "[Notice] Detected Rails 7 application"
+            notify_version 7
           elsif @rails_version.start_with? "8"
             tracker.options[:rails3] = true
             tracker.options[:rails4] = true
@@ -118,14 +118,14 @@ module Brakeman
             tracker.options[:rails6] = true
             tracker.options[:rails7] = true
             tracker.options[:rails8] = true
-            Brakeman.notify "[Notice] Detected Rails 8 application"
+            notify_version 8
           end
         end
       end
 
       if get_gem :rails_xss
         @escape_html = true
-        Brakeman.notify "[Notice] Escaping HTML by default"
+        Brakeman.debug "Escaping HTML by default"
       end
     end
 
@@ -182,7 +182,7 @@ module Brakeman
         option = config[o]
 
         if not option.is_a? Hash
-          Brakeman.debug "[Notice] Skipping config setting: #{path.map(&:to_s).join(".")}"
+          Brakeman.debug "Skipping config setting: #{path.map(&:to_s).join(".")}"
           return
         end
 
@@ -202,7 +202,7 @@ module Brakeman
       version = tracker.config.rails[:load_defaults].value.to_s
 
       unless version.match?(/^\d+\.\d+$/)
-        Brakeman.debug "[Notice] Unknown version: #{tracker.config.rails[:load_defaults]}"
+        Brakeman.alert "Unknown version: #{tracker.config.rails[:load_defaults]}"
         return
       end
 
@@ -284,5 +284,9 @@ module Brakeman
         set_rails_config(value: true_value, path: [:active_support, :use_rfc4122_namespaced_uuids])
       end
     end
+
+    private def notify_version version
+      Brakeman.debug "Detected Rails #{version} application"
+    end
   end
 end

data/lib/brakeman/tracker/constants.rb

@@ -29,7 +29,7 @@ module Brakeman
 
     def set_name name, context
       @name = name
-      @name_array = Constants.constant_as_array(name)
+      @name_array = Constants.constant_as_array(name, context)
     end
 
     def match? name
@@ -129,7 +129,22 @@ module Brakeman
       end
     end
 
-    def self.constant_as_array exp
+    def self.constant_as_array exp, context = nil
+      # Only prepend context for simple (unqualified) constants
+      if context && (exp.is_a?(Symbol) || (exp.is_a?(Sexp) && exp.node_type == :const))
+        context_name = context[:module] || context[:class]
+        context_name = context_name.name if context_name.respond_to?(:name)
+        if context_name
+          # Build colon2 chain: A::B becomes s(:colon2, s(:const, :A), :B)
+          parts = context_name.to_s.split("::")
+          base = Sexp.new(:const, parts.first.to_sym)
+          parts[1..].each do |part|
+            base = Sexp.new(:colon2, base, part.to_sym)
+          end
+          exp = Sexp.new(:colon2, base, exp)
+        end
+      end
+
       res = []
       while exp
         if exp.is_a? Sexp

data/lib/brakeman/tracker/controller.rb

@@ -132,7 +132,7 @@ module Brakeman
           when :lit, :str
             filter[option.value] = value[1]
           else
-            Brakeman.debug "[Notice] Unknown before_filter value: #{option} => #{value}"
+            Brakeman.debug "Unknown before_filter value: #{option} => #{value}"
           end
         end
       else

data/lib/brakeman/tracker.rb

@@ -101,15 +101,9 @@ class Brakeman::Tracker
     @app_path ||= File.expand_path @options[:app_path]
   end
 
-  #Iterate over all methods in controllers and models.
+  #Iterate over all methods
   def each_method
-    classes = [self.controllers, self.models]
-
-    if @options[:index_libs]
-      classes << self.libs
-    end
-
-    classes.each do |set|
+    [self.controllers, self.models, self.libs].each do |set|
       set.each do |set_name, collection|
         collection.each_method do |method_name, definition|
           src = definition.src
@@ -137,13 +131,7 @@ class Brakeman::Tracker
 
 
   def each_class
-    classes = [self.controllers, self.models]
-
-    if @options[:index_libs]
-      classes << self.libs
-    end
-
-    classes.each do |set|
+    [self.controllers, self.models, self.libs].each do |set|
       set.each do |set_name, collection|
         collection.src.each do |file, src|
           yield src, set_name, file
@@ -329,6 +317,8 @@ class Brakeman::Tracker
     finder = Brakeman::FindAllCalls.new self
 
     method_sets.each do |set|
+      Brakeman.logger.spin
+
       set.each do |set_name, info|
         info.each_method do |method_name, definition|
           src = definition.src
@@ -339,12 +329,14 @@ class Brakeman::Tracker
 
     if locations.include? :templates
       self.each_template do |_name, template|
+        Brakeman.logger.spin
         finder.process_source template.src, :template => template, :file => template.file
       end
     end
 
     if locations.include? :initializers
       self.initializers.each do |file_name, src|
+        Brakeman.logger.spin
         finder.process_all_source src, :file => file_name
       end
     end

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "7.1.2"
+  Version = "8.0.6"
 end

data/lib/brakeman.rb

@@ -1,4 +1,5 @@
 require 'set'
+require 'brakeman/logger'
 require 'brakeman/version'
 
 module Brakeman
@@ -32,6 +33,7 @@ module Brakeman
   @quiet = false
   @loaded_dependencies = []
   @vendored_paths = false
+  @logger = nil
 
   #Run Brakeman scan. Returns Tracker object.
   #
@@ -52,7 +54,6 @@ module Brakeman
   #  * :highlight_user_input - highlight user input in reported warnings (default: true)
   #  * :html_style - path to CSS file
   #  * :ignore_model_output - consider models safe (default: false)
-  #  * :index_libs - add libraries to call index (default: true)
   #  * :interprocedural - limited interprocedural processing of method calls (default: false)
   #  * :message_limit - limit length of messages
   #  * :min_confidence - minimum confidence (0-2, 0 is highest)
@@ -71,7 +72,6 @@ module Brakeman
   #  * :safe_methods - array of methods to consider safe
   #  * :show_ignored - Display warnings that are usually ignored
   #  * :sql_safe_methods - array of sql sanitization methods to consider safe
-  #  * :skip_libs - do not process lib/ directory (default: false)
   #  * :skip_vendor - do not process vendor/ directory (default: true)
   #  * :skip_checks - checks not to run (run all if not specified)
   #  * :absolute_paths - show absolute path of each file (default: false)
@@ -79,6 +79,10 @@ module Brakeman
   #
   #Alternatively, just supply a path as a string.
   def self.run options
+    if not $stderr.tty? and options[:report_progress].nil?
+      options[:report_progress] = false
+    end
+
     options = set_options options
 
     @quiet = !!options[:quiet]
@@ -88,18 +92,37 @@ module Brakeman
       options[:report_progress] = false
     end
 
+    @logger = options[:logger] || set_default_logger(options)
+
     if options[:use_prism]
       begin
         require 'prism'
-        notify '[Notice] Using Prism parser'
       rescue LoadError => e
-        Brakeman.debug "[Notice] Asked to use Prism, but failed to load: #{e}"
+        Brakeman.alert "Asked to use Prism, but failed to load: #{e}"
       end
     end
 
+    Brakeman.announce "Brakeman v#{Brakeman::Version}"
+
     scan options
   end
 
+  def self.logger
+    @logger
+  end
+
+  def self.logger= log
+    @logger = log
+  end
+
+  def self.set_default_logger(options = {})
+    @logger = Brakeman::Logger.get_logger(options)
+  end
+
+  def self.cleanup(newline = true)
+    @logger.cleanup(newline) if @logger
+  end
+
   #Sets up options for run, checks given application path
   def self.set_options options
     if options.is_a? String
@@ -144,7 +167,6 @@ module Brakeman
   #Load options from YAML file
   def self.load_options line_options
     custom_location = line_options[:config_file]
-    quiet = line_options[:quiet]
     app_path = line_options[:app_path]
 
     #Load configuration file
@@ -158,19 +180,22 @@ module Brakeman
         # After parsing the yaml config file for options, convert any string keys into symbols.
         options.keys.select {|k| k.is_a? String}.map {|k| k.to_sym }.each {|k| options[k] = options[k.to_s]; options.delete(k.to_s) }
 
+        # Brakeman.logger is probably not set yet
+        logger = Brakeman::Logger.get_logger(options.merge(line_options))
+
         unless line_options[:allow_check_paths_in_config]
           if options.include? :additional_checks_path
             options.delete :additional_checks_path
 
-            notify "[Notice] Ignoring additional check paths in config file. Use --allow-check-paths-in-config to allow" unless (options[:quiet] || quiet)
+            logger.alert 'Ignoring additional check paths in config file. Use --allow-check-paths-in-config to allow'
           end
         end
 
-        # notify if options[:quiet] and quiet is nil||false
-        notify "[Notice] Using configuration in #{config}" unless (options[:quiet] || quiet)
+        logger.alert "Using configuration in #{config}"
         options
       else
-        notify "[Notice] Empty configuration file: #{config}" unless quiet
+        logger = Brakeman::Logger.get_logger(line_options)
+        logger.alert "Empty configuration file: #{config}"
         {}
       end
     else
@@ -209,7 +234,6 @@ module Brakeman
       :html_style => "#{File.expand_path(File.dirname(__FILE__))}/brakeman/format/style.css",
       :ignore_model_output => false,
       :ignore_redirect_to_model => true,
-      :index_libs => true,
       :message_limit => 100,
       :min_confidence => 2,
       :output_color => true,
@@ -367,6 +391,12 @@ module Brakeman
 
     options.delete :create_config
 
+    if options[:logger]
+      @logger = options.delete(:logger)
+    else
+      set_default_logger(options)
+    end
+
     options.each do |k,v|
       if v.is_a? Set
         options[k] = v.to_a
@@ -377,60 +407,73 @@ module Brakeman
       File.open file, "w" do |f|
         YAML.dump options, f
       end
-      notify "Output configuration to #{file}"
+
+      announce "Output configuration to #{file}"
     else
-      notify YAML.dump(options)
+      $stdout.puts YAML.dump(options)
     end
   end
 
-  def self.ensure_latest
+  # Returns quit message unless the latest version
+  # of Brakeman matches the current version.
+  #
+  # Optionally checks that the latest version is at least
+  # the specified number of days old.
+  def self.ensure_latest(days_old: 0)
+    require 'date'
+
     current = Brakeman::Version
-    latest = Gem.latest_version_for('brakeman').to_s
-    if current != latest
-      "Brakeman #{current} is not the latest version #{latest}"
+    latest = Gem.latest_spec_for('brakeman')
+    release_date = latest.date.to_date
+    latest_version = latest.version.to_s
+
+    if (Date.today - release_date) >= days_old
+      if current != latest_version
+        return "Brakeman #{current} is not the latest version #{latest_version}"
+      else
+        false
+      end
+    else
+      false
     end
   end
 
   #Run a scan. Generally called from Brakeman.run instead of directly.
   def self.scan options
     #Load scanner
-    notify "Loading scanner..."
+    scanner, tracker = nil
 
-    begin
-      require 'brakeman/scanner'
-    rescue LoadError
-      raise NoBrakemanError, "Cannot find lib/ directory."
-    end
+    process_step 'Loading scanner' do
+      begin
+        require 'brakeman/scanner'
+      rescue LoadError
+        raise NoBrakemanError, 'Cannot find lib/ directory.'
+      end
 
-    add_external_checks options
+      add_external_checks options
 
-    #Start scanning
-    scanner = Scanner.new options
-    tracker = scanner.tracker
+      #Start scanning
+      scanner = Scanner.new options
+      tracker = scanner.tracker
 
-    check_for_missing_checks options[:run_checks], options[:skip_checks], options[:enable_checks]
+      check_for_missing_checks options[:run_checks], options[:skip_checks], options[:enable_checks]
+    end
 
-    notify "Processing application in #{tracker.app_path}"
+    logger.announce "Scanning #{tracker.app_path}"
     scanner.process
 
-    if options[:parallel_checks]
-      notify "Running checks in parallel..."
-    else
-      notify "Running checks..."
-    end
-
     tracker.run_checks
 
     self.filter_warnings tracker, options
 
     if options[:output_files]
-      notify "Generating report..."
-
-      write_report_to_files tracker, options[:output_files]
+      process_step 'Generating report' do
+        write_report_to_files tracker, options[:output_files]
+      end
     elsif options[:print_report]
-      notify "Generating report..."
-
-      write_report_to_formats tracker, options[:output_formats]
+      process_step 'Generating report' do
+        write_report_to_formats tracker, options[:output_formats]
+      end
     end
 
     tracker
@@ -449,7 +492,8 @@ module Brakeman
       File.open output_file, "w" do |f|
         f.write tracker.report.format(tracker.options[:output_formats][idx])
       end
-      notify "Report saved in '#{output_file}'"
+
+      logger.announce "Report saved in '#{output_file}'"
     end
   end
   private_class_method :write_report_to_files
@@ -493,12 +537,16 @@ module Brakeman
     Rescanner.new(options, tracker.processor, files).recheck
   end
 
-  def self.notify message
-    $stderr.puts message unless @quiet
+  def self.announce message
+    logger.announce message
+  end
+
+  def self.alert message
+    logger.alert message
   end
 
   def self.debug message
-    $stderr.puts message if @debug
+    logger.debug message
   end
 
   # Compare JSON output from a previous scan and return the diff of the two scans
@@ -510,7 +558,7 @@ module Brakeman
     begin
       previous_results = JSON.parse(File.read(options[:previous_results_json]), :symbolize_names => true)[:warnings]
     rescue JSON::ParserError
-      self.notify "Error parsing comparison file: #{options[:previous_results_json]}"
+      self.alert "Error parsing comparison file: #{options[:previous_results_json]}"
       exit!
     end
 
@@ -565,6 +613,7 @@ module Brakeman
 
   def self.filter_warnings tracker, options
     require 'brakeman/report/ignore/config'
+    config = nil
 
     app_tree = Brakeman::AppTree.from_options(options)
 
@@ -576,16 +625,17 @@ module Brakeman
       return
     end
 
-    notify "Filtering warnings..."
-
-    if options[:interactive_ignore]
-      require 'brakeman/report/ignore/interactive'
-      config = InteractiveIgnorer.new(file, tracker.warnings).start
-    else
-      notify "[Notice] Using '#{file}' to filter warnings"
-      config = IgnoreConfig.new(file, tracker.warnings)
-      config.read_from_file
-      config.filter_ignored
+    process_step "Filtering warnings..." do
+      if options[:interactive_ignore]
+        require 'brakeman/report/ignore/interactive'
+        logger.cleanup
+        config = InteractiveIgnorer.new(file, tracker.warnings).start
+      else
+        logger.announce "Using '#{file}' to filter warnings"
+        config = IgnoreConfig.new(file, tracker.warnings)
+        config.read_from_file
+        config.filter_ignored
+      end
     end
 
     tracker.ignored_filter = config
@@ -615,6 +665,10 @@ module Brakeman
     @quiet = val
   end
 
+  def self.process_step(description, &)
+    logger.context(description, &)
+  end
+
   class DependencyError < RuntimeError; end
   class NoBrakemanError < RuntimeError; end
   class NoApplication < RuntimeError; end