brakeman 1.9.0.pre1 → 1.9.0.pre2

data/lib/brakeman/checks/check_execute.rb

@@ -43,7 +43,7 @@ class Brakeman::CheckExecute < Brakeman::BaseCheck
     if failure and not duplicate? result
       add_result result
 
-      if @string_interp
+      if failure.type == :interp #Not from user input
         confidence = CONFIDENCE[:med]
       else
         confidence = CONFIDENCE[:high]

data/lib/brakeman/checks/check_session_settings.rb

@@ -42,7 +42,7 @@ class Brakeman::CheckSessionSettings < Brakeman::BaseCheck
   #in Rails 3.x apps
   def process_call exp
     if tracker.options[:rails3] and settings_target?(exp.target) and exp.method == :session_store
-      check_for_issues exp.second_arg, "#{tracker.options[:app_path]}/config/initializers/session_store.rb"
+      check_for_rails3_issues exp.second_arg, "#{tracker.options[:app_path]}/config/initializers/session_store.rb"
     end
       
     exp
@@ -59,27 +59,61 @@ class Brakeman::CheckSessionSettings < Brakeman::BaseCheck
 
   def check_for_issues settings, file
     if settings and hash? settings
-      if value = hash_access(settings, :session_http_only)
+      if value = (hash_access(settings, :session_http_only) ||
+                  hash_access(settings, :http_only) ||
+                  hash_access(settings, :httponly))
+
         if false? value
-          warn :warning_type => "Session Setting",
-            :message => "Session cookies should be set to HTTP only",
-            :confidence => CONFIDENCE[:high],
-            :line => value.line,
-            :file => file
+          warn_about_http_only value, file
         end
       end
 
       if value = hash_access(settings, :secret)
         if string? value and value.value.length < 30
+          warn_about_secret_length value, file
+        end
+      end
+    end
+  end
 
-          warn :warning_type => "Session Setting",
-            :message => "Session secret should be at least 30 characters long",
-            :confidence => CONFIDENCE[:high],
-            :line => value.line,
-            :file => file
+  def check_for_rails3_issues settings, file
+    if settings and hash? settings
+      if value = hash_access(settings, :httponly)
+        if false? value
+          warn_about_http_only value, file
+        end
+      end
 
+      if value = hash_access(settings, :secure)
+        if false? value
+          warn_about_secure_only value, file
         end
       end
     end
   end
+
+  def warn_about_http_only value, file
+    warn :warning_type => "Session Setting",
+      :message => "Session cookies should be set to HTTP only",
+      :confidence => CONFIDENCE[:high],
+      :line => value.line,
+      :file => file
+
+  end
+
+  def warn_about_secret_length value, file
+    warn :warning_type => "Session Setting",
+      :message => "Session secret should be at least 30 characters long",
+      :confidence => CONFIDENCE[:high],
+      :line => value.line,
+      :file => file
+  end
+
+  def warn_about_secure_only value, file
+    warn :warning_type => "Session Setting",
+      :message => "Session cookie should be set to secure only",
+      :confidence => CONFIDENCE[:high],
+      :line => value.line,
+      :file => file
+  end
 end

data/lib/brakeman/processors/alias_processor.rb

@@ -38,31 +38,9 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
   #This method returns a new Sexp with variables replaced with their values,
   #where possible.
   def process_safely src, set_env = nil
-    @env = Marshal.load(Marshal.dump(set_env)) if set_env
+    @env = set_env || SexpProcessor::Environment.new
     @result = src.deep_clone
     process @result
-
-    #Process again to propogate replaced variables and process more.
-    #For example,
-    #  x = [1,2]
-    #  y = [3,4]
-    #  z = x + y
-    #
-    #After first pass:
-    #
-    #  z = [1,2] + [3,4]
-    #
-    #After second pass:
-    #
-    #  z = [1,2,3,4]
-    if set_env
-      @env = set_env
-    else
-      @env = SexpProcessor::Environment.new
-    end
-
-    process @result
-
     @result
   end
 

data/lib/brakeman/processors/controller_alias_processor.rb

@@ -158,7 +158,7 @@ class Brakeman::ControllerAliasProcessor < Brakeman::AliasProcessor
       end
     else
       processor = Brakeman::AliasProcessor.new @tracker
-      processor.process_safely(method.body_list)
+      processor.process_safely(method.body_list, only_ivars(:include_request_vars))
 
       ivars = processor.only_ivars(:include_request_vars).all
 

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "1.9.0.pre1"
+  Version = "1.9.0.pre2"
 end

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification 
 name: brakeman
 version: !ruby/object:Gem::Version 
-  hash: -4135741142
+  hash: 1770954203
   prerelease: 6
   segments: 
   - 1
   - 9
   - 0
   - pre
-  - 1
-  version: 1.9.0.pre1
+  - 2
+  version: 1.9.0.pre2
 platform: ruby
 authors: 
 - Justin Collins
@@ -17,7 +17,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-12-21 00:00:00 Z
+date: 2012-12-24 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: activesupport