brakeman 8.0.4 → 8.0.6

data/bundle/ruby/3.2.0/gems/{temple-0.10.4 → temple-0.10.6}/lib/temple/filters/string_splitter.rb

@@ -1,14 +1,70 @@
 # frozen_string_literal: true
-begin
-  require 'ripper'
-rescue LoadError
-end
+require 'temple/parser_engine'
 
 module Temple
   module Filters
     # Compile [:dynamic, "foo#{bar}"] to [:multi, [:static, 'foo'], [:dynamic, 'bar']]
     class StringSplitter < Filter
-      if defined?(Ripper) && Ripper.respond_to?(:lex)
+      if PARSER_ENGINE == :prism
+        class << self
+          # `code` param must be valid string literal
+          def compile(code)
+            compiled = try_compile(code)
+            raise(FilterError, "Expected string literal") unless compiled
+            compiled
+          end
+
+          def try_compile(code)
+            result = Prism.parse(code)
+            return unless result.success?
+
+            stmts = result.value.statements.body
+            return if stmts.size != 1
+
+            stack = [stmts.first]
+            compiled = []
+
+            until stack.empty?
+              case (node = stack.pop).type
+              when :interpolated_string_node
+                stack.concat(node.parts.reverse)
+              when :string_node
+                if !(unescaped = node.unescaped).empty?
+                  compiled << [:static, unescaped]
+                end
+              when :embedded_statements_node
+                if (stmts = node.statements) && !(slice = stmts.slice).empty?
+                  compiled << [:dynamic, slice]
+                end
+              when :embedded_variable_node
+                compiled << [:dynamic, node.variable.slice]
+              else
+                return
+              end
+            end
+
+            compiled
+          end
+        end
+
+        def on_dynamic(code)
+          return [:dynamic, code] if code.include?("\n")
+
+          compiled = StringSplitter.try_compile(code)
+          return [:dynamic, code] unless compiled
+
+          temple = [:multi]
+          compiled.each do |type, content|
+            case type
+            when :static
+              temple << [:static, content]
+            when :dynamic
+              temple << on_dynamic(content)
+            end
+          end
+          temple
+        end
+      elsif PARSER_ENGINE == :ripper
         class << self
           # `code` param must be valid string literal
           def compile(code)

data/bundle/ruby/3.2.0/gems/temple-0.10.6/lib/temple/parser_engine.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Temple
+  temple_parser_engine = ENV['TEMPLE_PARSER_ENGINE']
+
+  prism_available =
+    if !temple_parser_engine || temple_parser_engine == 'prism'
+      begin
+        require 'prism'
+        true
+      rescue LoadError
+      end
+    end
+
+  ripper_available =
+    if !temple_parser_engine || temple_parser_engine == 'ripper'
+      begin
+        require 'ripper'
+        Ripper.respond_to?(:lex)
+      rescue LoadError
+      end
+    end
+
+  PARSER_ENGINE =
+    if prism_available
+      :prism
+    elsif ripper_available
+      :ripper
+    else
+      :none
+    end
+
+  private_constant :PARSER_ENGINE
+end

data/bundle/ruby/3.2.0/gems/temple-0.10.6/lib/temple/static_analyzer.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+require 'temple/parser_engine'
+
+module Temple
+  module StaticAnalyzer
+    if PARSER_ENGINE == :prism
+      class << self
+        def available?
+          true
+        end
+
+        def static?(code)
+          return false if code.nil? || code.strip.empty?
+          (result = Prism.parse(code)).success? && static_node?(result.value)
+        end
+
+        def syntax_error?(code)
+          !Prism.parse_success?(code)
+        end
+
+        private
+
+        def static_node?(node)
+          case node.type
+          when :program_node
+            static_node?(node.statements)
+          when :parentheses_node
+            (stmts = node.body).is_a?(Prism::StatementsNode) &&
+              static_node?(stmts)
+          when :statements_node
+            node.body.size == 1 && static_node?(node.body.first)
+          when :interpolated_string_node
+            node.parts.all? { |part| static_node?(part) }
+          when :embedded_statements_node
+            (stmts = node.statements) && static_node?(stmts)
+          when :array_node
+            node.elements.all? { |elem| static_node?(elem) }
+          when :hash_node, :keyword_hash_node
+            node.elements.all? { |elem| static_node?(elem) }
+          when :assoc_node
+            static_node?(node.key) && static_node?(node.value)
+          when :string_node, :integer_node, :float_node, :imaginary_node,
+               :rational_node, :symbol_node, :true_node, :false_node, :nil_node
+            true
+          else
+            false
+          end
+        end
+      end
+    elsif PARSER_ENGINE == :ripper
+      STATIC_TOKENS = [
+        :on_tstring_beg, :on_tstring_end, :on_tstring_content,
+        :on_embexpr_beg, :on_embexpr_end,
+        :on_lbracket, :on_rbracket,
+        :on_qwords_beg, :on_words_sep, :on_qwords_sep,
+        :on_lparen, :on_rparen,
+        :on_lbrace, :on_rbrace, :on_label,
+        :on_int, :on_float, :on_imaginary,
+        :on_comma, :on_sp, :on_ignored_nl,
+      ].freeze
+
+      DYNAMIC_TOKENS = [
+        :on_ident, :on_period,
+      ].freeze
+
+      STATIC_KEYWORDS = [
+        'true', 'false', 'nil',
+      ].freeze
+
+      STATIC_OPERATORS = [
+        '=>',
+      ].freeze
+
+      class << self
+        def available?
+          true
+        end
+
+        def static?(code)
+          return false if code.nil? || code.strip.empty? || syntax_error?(code)
+
+          Ripper.lex(code).each do |_, token, str|
+            case token
+            when *STATIC_TOKENS
+              # noop
+            when :on_kw
+              return false unless STATIC_KEYWORDS.include?(str)
+            when :on_op
+              return false unless STATIC_OPERATORS.include?(str)
+            when *DYNAMIC_TOKENS
+              return false
+            else
+              return false
+            end
+          end
+
+          !ShorthandSyntaxChecker.shorthand?(code)
+        end
+
+        def syntax_error?(code)
+          SyntaxChecker.new(code).parse
+          false
+        rescue SyntaxChecker::ParseError
+          true
+        end
+
+        class SyntaxChecker < Ripper
+          class ParseError < StandardError; end
+
+          private
+
+          def on_parse_error(*)
+            raise ParseError
+          end
+        end
+
+        class ShorthandSyntaxChecker < Ripper
+          class << self
+            def shorthand?(code)
+              instance = new(code)
+              instance.parse
+              instance.shorthand
+            end
+          end
+
+          attr_reader :shorthand
+
+          def initialize(*)
+            super
+            @shorthand = nil
+          end
+
+          private
+
+          def on_assoc_new(key, value)
+            @shorthand = true if value.nil?
+          end
+        end
+      end
+    else
+      class << self
+        def available?
+          false
+        end
+      end
+    end
+  end
+end

data/bundle/ruby/3.2.0/gems/{temple-0.10.4 → temple-0.10.6}/lib/temple/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Temple
-  VERSION = '0.10.4'
+  VERSION = '0.10.6'
 end

data/bundle/ruby/3.2.0/gems/{tilt-2.7.0 → tilt-2.8.0}/COPYING

@@ -1,5 +1,5 @@
 Copyright (c) 2010-2016 Ryan Tomayko <http://tomayko.com/about>
-Copyright (c) 2015-2023 Jeremy Evans
+Copyright (c) 2015-2026 Jeremy Evans and contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to

data/bundle/ruby/3.2.0/gems/{tilt-2.7.0 → tilt-2.8.0}/lib/tilt/commonmarker.rb

@@ -50,14 +50,24 @@ if defined?(::Commonmarker)
   parse_opts = [
     :smart,
     :default_info_string,
+    :relaxed_tasklist_matching,
+    :relaxed_autolinks,
+    :leave_footnote_definitions,
+    :ignore_setext,
   ].freeze
   render_opts = [
     :hardbreaks,
     :github_pre_lang,
+    :full_info_string,
     :width,
     :unsafe,
     :escape,
     :sourcepos,
+    :escaped_char_spans,
+    :ignore_empty_links,
+    :gfm_quirks,
+    :prefer_fenced,
+    :tasklist_classes,
   ].freeze
   exts = [
     :strikethrough,
@@ -68,9 +78,23 @@ if defined?(::Commonmarker)
     :superscript,
     :header_ids,
     :footnotes,
+    :inline_footnotes,
     :description_lists,
     :front_matter_delimiter,
+    :multiline_block_quotes,
+    :math_dollars,
+    :math_code,
     :shortcodes,
+    :wikilinks_title_before_pipe,
+    :wikilinks_title_after_pipe,
+    :underline,
+    :spoiler,
+    :greentext,
+    :subscript,
+    :subtext,
+    :alerts,
+    :cjk_friendly_emphasis,
+    :highlight,
   ].freeze
 
   Tilt::CommonMarkerTemplate = Tilt::StaticTemplate.subclass do

data/bundle/ruby/3.2.0/gems/{tilt-2.7.0 → tilt-2.8.0}/lib/tilt/rdoc.rb

@@ -28,6 +28,14 @@ require 'rdoc/markup'
 require 'rdoc/markup/to_html'
 require 'rdoc/options'
 
-Tilt::RDocTemplate = Tilt::StaticTemplate.subclass do
-  RDoc::Markup::ToHtml.new(RDoc::Options.new, nil).convert(@data).to_s
+Tilt::RDocTemplate = if defined?(RDoc::VERSION) && RDoc::VERSION >= "8"
+  Tilt::StaticTemplate.subclass do
+    RDoc::Markup::ToHtml.new.convert(@data).to_s
+  end
+# :nocov:
+else
+  Tilt::StaticTemplate.subclass do
+    RDoc::Markup::ToHtml.new(RDoc::Options.new, nil).convert(@data).to_s
+  end
 end
+# :nocov:

data/bundle/ruby/3.2.0/gems/{tilt-2.7.0 → tilt-2.8.0}/lib/tilt.rb

@@ -5,7 +5,7 @@ require_relative 'tilt/template'
 # Namespace for Tilt. This module is not intended to be included anywhere.
 module Tilt
   # Current version.
-  VERSION = '2.7.0'
+  VERSION = '2.8.0'
 
   EMPTY_ARRAY = [].freeze
   private_constant :EMPTY_ARRAY

data/lib/brakeman/checks/check_eol_rails.rb

@@ -25,6 +25,7 @@ class Brakeman::CheckEOLRails < Brakeman::EOLCheck
     ['7.0.0', '7.0.99'] => Date.new(2025, 4, 1),
     ['7.1.0', '7.1.99'] => Date.new(2025, 10, 1),
     ['7.2.0', '7.2.99'] => Date.new(2026, 8, 9),
-    ['8.0.0', '8.0.99'] => Date.new(2026, 10, 7),
+    ['8.0.0', '8.0.99'] => Date.new(2026, 11, 7),
+    ['8.1.0', '8.1.99'] => Date.new(2027, 10, 10),
   }
 end

data/lib/brakeman/checks/check_eol_ruby.rb

@@ -26,5 +26,6 @@ class Brakeman::CheckEOLRuby < Brakeman::EOLCheck
     ['3.2.0', '3.2.99'] => Date.new(2026, 3, 31),
     ['3.3.0', '3.3.99'] => Date.new(2027, 3, 31),
     ['3.4.0', '3.4.99'] => Date.new(2028, 3, 31),
+    ['4.0.0', '4.0.99'] => Date.new(2029, 3, 31),
   }
 end

data/lib/brakeman/checks/check_execute.rb

@@ -55,6 +55,13 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     first_arg = call.first_arg
     failure = nil
 
+    # All spawn-family methods optionally accept an env hash as the first
+    # argument. Strip it so first_arg always points to the command name.
+    if hash?(first_arg)
+      args.delete_at(1)
+      first_arg = args[1]
+    end
+
     case call.method
     when :popen
       # Normally, if we're in a `popen` call, we only are worried about shell
@@ -99,14 +106,17 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
 
         break if failure
       end
-    when :system, :exec
-      # Normally, if we're in a `system` or `exec` call, we only are worried
-      # about shell injection when there's a single argument, because comma-
-      # separated arguments are always escaped by Ruby. However, an exception is
-      # when the first two arguments are something like "bash -c" because then
-      # the third argument is effectively the command being run and might be
-      # a malicious executable if it comes (partially or fully) from user input.
-      if dash_c_shell_command?(first_arg, call.second_arg)
+    when :system, :exec, :spawn, :capture2, :capture2e, :capture3,
+         :popen2, :popen2e, :popen3
+      # Comma-separated arguments are passed directly to execve without a
+      # shell, so only the first argument (the command name) needs checking.
+      # Exception: `bash -c <script>` — the script is the injection vector.
+      #
+      # All of these methods accept an optional trailing options hash
+      # (e.g. stdin_data:, chdir:); strip it before checking.
+      args.pop if hash?(args.last) && args.length > 2
+
+      if dash_c_shell_command?(first_arg, args[2])
         failure = include_user_input?(args[3]) ||
                   dangerous_interp?(args[3]) ||
                   dangerous_string_building?(args[3])
@@ -115,16 +125,6 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
                   dangerous_interp?(first_arg) ||
                   dangerous_string_building?(first_arg)
       end
-    when :capture2, :capture2e, :capture3
-      # Open3 capture methods can take a :stdin_data argument which is used as the
-      # the input to the called command so it is not succeptable to command injection.
-      # As such if the last argument is a hash (and therefore execution options) it
-      # should be ignored
-
-      args.pop if hash?(args.last) && args.length > 2
-      failure = include_user_input?(args) ||
-                dangerous_interp?(args) ||
-                dangerous_string_building?(args)
     else
       failure = include_user_input?(args) ||
                 dangerous_interp?(args) ||
@@ -176,6 +176,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
   def include_user_input? exp
     if node_type? exp, :arglist, :dstr, :evstr, :dxstr
       exp.each_sexp do |e|
+        next if shell_escape? e
+
         if res = include_user_input?(e)
           return res
         end
@@ -196,7 +198,7 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
       # Check for input at start of string
       exp[1] == "" and
         node_type? exp[2], :evstr and
-        has_immediate_user_input? exp[2]
+        dangerous? exp[2]
     else
       has_immediate_user_input? exp
     end
@@ -266,6 +268,8 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
   end
 
   def dangerous_interp? exp
+    return if shell_escape? exp
+
     match = include_interp? exp
     return unless match
     interp = match.match

data/lib/brakeman/checks/check_sql.rb

@@ -311,7 +311,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     end
 
     if request_value? arg
-      unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash, :symbolize_keys].include? arg.method
+      unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash, :symbolize_keys, :compact, :compact_blank].include? arg.method
         # Model.where(params[:where])
         arg
       end
@@ -645,7 +645,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
       locale_call? exp
   end
 
-  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name]
+  QUOTE_METHODS = [:quote, :quote_column_name, :quoted_date, :quote_string, :quote_table_name, :quote_schema_name]
 
   def quote_call? exp
     if call? exp.target

data/lib/brakeman/processors/base_processor.rb

@@ -258,12 +258,19 @@ class Brakeman::BaseProcessor < Brakeman::SexpProcessor
     #Look for "type" of render in options hash
     #For example, render :file => "blah"
     if hash? last_arg
-      hash_iterate(last_arg) do |key, val|
-        if symbol? key and types_in_hash.include? key.value
-          type = key.value
-          value = val
-        else  
-          rest << key << val
+      if type
+        #The render type was already determined by a positional argument, so a
+        #key in the options hash that happens to match a render type name (e.g.
+        #`text:`) is a local passed to the partial/action, not a type directive.
+        rest = last_arg
+      else
+        hash_iterate(last_arg) do |key, val|
+          if symbol? key and types_in_hash.include? key.value
+            type = key.value
+            value = val
+          else
+            rest << key << val
+          end
         end
       end
     end

data/lib/brakeman/processors/gem_processor.rb

@@ -6,7 +6,7 @@ class Brakeman::GemProcessor < Brakeman::BasicProcessor
   def initialize *args
     super
     @gem_name_version = /^\s*([-_+.A-Za-z0-9]+) \((\w(\.\w+)*)\)/
-    @ruby_version = /^\s+ruby (\d\.\d.\d+)/
+    @ruby_version = /^\s+ruby (\d+\.\d+\.\d+)/
   end
 
   def process_gems gem_files

data/lib/brakeman/processors/haml_template_processor.rb

@@ -186,6 +186,8 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor
 
   def raw? exp
     call? exp and
-      exp.method == :raw
+      exp.target.nil? and
+      exp.method == :raw and
+      exp.first_arg
   end
 end

data/lib/brakeman/processors/lib/render_helper.rb

@@ -19,7 +19,9 @@ module Brakeman::RenderHelper
       end
     when :default
       begin
-        process_template template_name, exp[3], nil, exp.line
+        # exp[2] is either the action name (from controller) or :default when no explicit arg
+        name_arg = (exp[2].nil? || exp[2] == :default) ? nil : exp[2]
+        process_template template_name(name_arg), exp[3], nil, exp.line
       rescue ArgumentError
         Brakeman.debug "Problem processing render: #{exp}"
       end

data/lib/brakeman/scanner.rb

@@ -187,8 +187,14 @@ class Brakeman::Scanner
     end
 
     if @app_tree.exists? ".ruby-version"
-      if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/]
-        tracker.config.set_ruby_version version, @app_tree.file_path(".ruby-version"), 1
+      contents = @app_tree.file_path(".ruby-version").read
+      # Skip alternative Ruby implementations — the EOL dates Brakeman knows
+      # about are MRI's, so a `.ruby-version` of "jruby-10.0.2.0" should not
+      # be parsed as MRI 0.0.2 / 10.0.2.
+      unless contents =~ /\A\s*(jruby|truffleruby|rbx|rubinius|mruby)\b/i
+        if version = contents[/(\d+\.\d+\.\d+)/]
+          tracker.config.set_ruby_version version, @app_tree.file_path(".ruby-version"), 1
+        end
       end
     end
 

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "8.0.4"
+  Version = "8.0.6"
 end

data/lib/brakeman.rb

@@ -427,7 +427,7 @@ module Brakeman
     release_date = latest.date.to_date
     latest_version = latest.version.to_s
 
-    if (Date.today - latest.date.to_date) >= days_old
+    if (Date.today - release_date) >= days_old
       if current != latest_version
         return "Brakeman #{current} is not the latest version #{latest_version}"
       else