brakeman 0.3.1 → 0.3.2

data/README.md

@@ -2,7 +2,7 @@
 
 Brakeman is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
 
-It targets Rails versions > 2.0 and < 3.0.
+It targets Rails versions > 2.0 with experimental support for Rails 3.x
 
 # Installation
 
@@ -25,7 +25,7 @@ To specify an output file for the results:
 
     brakeman -o output_file app_path
 
-The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, and `csv`.
+The output format is determined by the file extension or by using the `-f` option. Current options are: `text`, `html`, `csv`, and `tabs`.
 
 To suppress informational warnings and just output the report:
 
@@ -51,7 +51,7 @@ To indicate certain methods are "safe":
 
     brakeman -s benign_method,totally_safe app_path
 
-By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would a warning:
+By default, brakeman will assume that unknown methods involving untrusted data are dangerous. For example, this would cause a warning (Rails 2):
 
     <%= some_method(:option => params[:input]) %>
 
@@ -81,7 +81,7 @@ To only get warnings above a given confidence level:
 
     brakeman -w3 app_path
 
-The `-w` switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only high confidence warnings).
+The `-w` switch takes a number from 1 to 3, with 1 being low (all warnings) and 3 being high (only highest confidence warnings).
 
 # Configuration files
 

data/bin/brakeman

@@ -243,6 +243,11 @@ abort("Please supply the path to a Rails application.") unless app_path and File
 
 warn "[Notice] Using Ruby #{RUBY_VERSION}. Please make sure this matches the one used to run your Rails application."
 
+if File.exist? app_path + "/script/rails"
+  OPTIONS[:rails3] = true
+  warn "[Notice] Detected Rails 3 application. Enabling experimental Rails 3 support." 
+end
+
 #Load scanner
 begin
   require 'scanner'

data/lib/checks/check_mass_assignment.rb

@@ -24,7 +24,9 @@ class CheckMassAssignment < BaseCheck
       :attributes=, 
       :update_attribute, 
       :update_attributes, 
-      :update_attributes!]
+      :update_attributes!,
+      :create,
+      :create!]
 
     calls.each do |result|
       process result

data/lib/scanner.rb

@@ -61,7 +61,7 @@ class Scanner
       @processor.process_config(RubyParser.new.parse(File.read("#@path/config/gems.rb")))
     end
 
-    if File.exists? "#@path/vendor/plugins/rails_xss"
+    if File.exists? "#@path/vendor/plugins/rails_xss" or OPTIONS[:rails3]
       tracker.config[:escape_html] = true
       warn "[Notice] Escaping HTML by default"
     end

data/lib/version.rb

@@ -1 +1 @@
-Version = "0.3.1"
+Version = "0.3.2"

metadata

@@ -1,13 +1,12 @@
 --- !ruby/object:Gem::Specification 
 name: brakeman
 version: !ruby/object:Gem::Version 
-  hash: 17
-  prerelease: 
+  prerelease: false
   segments: 
   - 0
   - 3
-  - 1
-  version: 0.3.1
+  - 2
+  version: 0.3.2
 platform: ruby
 authors: 
 - Justin Collins
@@ -15,7 +14,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-05-03 00:00:00 -07:00
+date: 2011-05-12 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -26,7 +25,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 7
         segments: 
         - 2
         - 2
@@ -41,7 +39,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 23
         segments: 
         - 1
         - 2
@@ -57,7 +54,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 9
         segments: 
         - 1
         - 6
@@ -73,7 +69,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 29
         segments: 
         - 2
         - 6
@@ -89,7 +84,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        hash: 31
         segments: 
         - 3
         - 0
@@ -172,7 +166,6 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
       segments: 
       - 0
       version: "0"
@@ -181,14 +174,13 @@ required_rubygems_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      hash: 3
       segments: 
       - 0
       version: "0"
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.4.1
+rubygems_version: 1.3.7
 signing_key: 
 specification_version: 3
 summary: Security vulnerability scanner for Ruby on Rails.