brakeman 2.6.0 → 2.6.1

data/CHANGES

@@ -1,3 +1,9 @@
+# 2.6.1
+
+* Add check for CVE-2014-3482 and CVE-2014-3483
+* Add support for keyword arguments in blocks
+* Remove unused warning codes (Bill Fischer)
+
 # 2.6.0
 
 * Fix detection of `:host` setting in redirects with chained calls

data/lib/brakeman/checks/check_sql_cves.rb

@@ -48,6 +48,18 @@ class Brakeman::CheckSQLCVEs < Brakeman::BaseCheck
       }
     end
 
+    if tracker.config[:gems] and tracker.config[:gems][:pg]
+      issues << {
+        :cve => "CVE-2014-3482",
+        :versions => [%w[2.0.0 2.9.9 3.2.19], %w[3.0.0 3.2.18 3.2.19], %w[4.0.0 4.0.6 4.0.7], %w[4.1.0 4.1.2 4.1.3]],
+        :url => "https://groups.google.com/d/msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J"
+      } <<
+      {
+        :cve => "CVE-2014-3483",
+        :versions => [%w[2.0.0 2.9.9 3.2.19], %w[3.0.0 3.2.18 3.2.19], %w[4.0.0 4.0.6 4.0.7], %w[4.1.0 4.1.2 4.1.3]],
+        :url => "https://groups.google.com/d/msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J" }
+    end
+
     issues.each do |cve_issue|
       cve_warning_for cve_issue[:versions], cve_issue[:cve], cve_issue[:url]
     end

data/lib/brakeman/processors/alias_processor.rb

@@ -180,6 +180,8 @@ class Brakeman::AliasProcessor < Brakeman::SexpProcessor
         #Force block arg(s) to be local
         if node_type? e, :lasgn
           env.current[Sexp.new(:lvar, e.lhs)] = e.rhs
+        elsif node_type? e, :kwarg
+          env.current[Sexp.new(:lvar, e[1])] = e[2]
         elsif node_type? e, :masgn
           e[1..-1].each do |var|
             local = Sexp.new(:lvar, var)

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "2.6.0"
+  Version = "2.6.1"
 end

data/lib/brakeman/warning_codes.rb

@@ -41,7 +41,7 @@ module Brakeman::WarningCodes
     :CVE_2012_2660 => 38,
     :CVE_2012_2661 => 39,
     :CVE_2012_2695 => 40,
-    :CVE_2012_2931 => 41,
+    #:CVE_2012_2931 => 41,
     :CVE_2012_3424 => 42,
     :CVE_2012_3463 => 43,
     :CVE_2012_3464 => 44,
@@ -65,8 +65,9 @@ module Brakeman::WarningCodes
     :detailed_exceptions => 62,
     :CVE_2013_4491 => 63,
     :CVE_2013_6414 => 64,
-    :CVE_2013_6415 => 65,
-    :CVE_2013_6415_call => 66,
+    # Replaced by CVE_2014_0081
+    #:CVE_2013_6415 => 65,
+    #:CVE_2013_6415_call => 66,
     :CVE_2013_6416 => 67,
     :CVE_2013_6416_call => 68,
     :CVE_2013_6417 => 69,
@@ -78,6 +79,8 @@ module Brakeman::WarningCodes
     :CVE_2014_0082 => 75,
     :regex_dos => 76,
     :CVE_2014_0130 => 77,
+    :CVE_2014_3482 => 78,
+    :CVE_2014_3483 => 79,
   }
 
   def self.code name

metadata

@@ -1,7 +1,8 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 2.6.0
+  version: 2.6.1
+  prerelease: 
 platform: ruby
 authors:
 - Justin Collins
@@ -35,95 +36,78 @@ cert_chain:
   Q0c3bUZaNnhnaDAxZXFuWlVzTmQ4dk0rNlY2djIzVnUKamsydE1qRlQ0TDFk
   QTNNRXN6MytNUDE0NFBEaFBDaDd0UGU2eXk4MUJPdnlZVFZrS3pyQWtnS3dI
   RDFDdXZzSApiZHc9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
-date: 2014-06-06 00:00:00.000000000 Z
+date: 2014-07-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby_parser
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329568880 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: 3.5.0
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: 3.5.0
+  version_requirements: *70322329568880
 - !ruby/object:Gem::Dependency
   name: ruby2ruby
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329568380 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: 2.0.5
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: 2.0.5
+  version_requirements: *70322329568380
 - !ruby/object:Gem::Dependency
   name: terminal-table
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329567880 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '1.4'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '1.4'
+  version_requirements: *70322329567880
 - !ruby/object:Gem::Dependency
   name: fastercsv
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329567300 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '1.5'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '1.5'
+  version_requirements: *70322329567300
 - !ruby/object:Gem::Dependency
   name: highline
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329566800 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: 1.6.20
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: 1.6.20
+  version_requirements: *70322329566800
 - !ruby/object:Gem::Dependency
   name: erubis
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329566300 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '2.6'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '2.6'
+  version_requirements: *70322329566300
 - !ruby/object:Gem::Dependency
   name: haml
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329565820 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -133,31 +117,22 @@ dependencies:
         version: '5.0'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '3.0'
-    - - <
-      - !ruby/object:Gem::Version
-        version: '5.0'
+  version_requirements: *70322329565820
 - !ruby/object:Gem::Dependency
   name: sass
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329565100 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '3.0'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '3.0'
+  version_requirements: *70322329565100
 - !ruby/object:Gem::Dependency
   name: slim
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329564620 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -167,28 +142,18 @@ dependencies:
         version: '3.0'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: 1.3.6
-    - - <
-      - !ruby/object:Gem::Version
-        version: '3.0'
+  version_requirements: *70322329564620
 - !ruby/object:Gem::Dependency
   name: multi_json
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70322329580140 !ruby/object:Gem::Requirement
+    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
         version: '1.2'
   type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ~>
-      - !ruby/object:Gem::Version
-        version: '1.2'
+  version_requirements: *70322329580140
 description: Brakeman detects security vulnerabilities in Ruby on Rails applications
   via static analysis.
 email: gem@brakeman.org
@@ -197,16 +162,14 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- bin/brakeman
 - CHANGES
+- WARNING_TYPES
 - FEATURES
 - README.md
-- WARNING_TYPES
-- bin/brakeman
-- lib/brakeman.rb
 - lib/brakeman/app_tree.rb
 - lib/brakeman/brakeman.rake
 - lib/brakeman/call_index.rb
-- lib/brakeman/checks.rb
 - lib/brakeman/checks/base_check.rb
 - lib/brakeman/checks/check_basic_auth.rb
 - lib/brakeman/checks/check_content_tag.rb
@@ -260,6 +223,7 @@ files:
 - lib/brakeman/checks/check_validation_regex.rb
 - lib/brakeman/checks/check_without_protection.rb
 - lib/brakeman/checks/check_yaml_parsing.rb
+- lib/brakeman/checks.rb
 - lib/brakeman/differ.rb
 - lib/brakeman/file_parser.rb
 - lib/brakeman/format/style.css
@@ -295,7 +259,6 @@ files:
 - lib/brakeman/processors/slim_template_processor.rb
 - lib/brakeman/processors/template_alias_processor.rb
 - lib/brakeman/processors/template_processor.rb
-- lib/brakeman/report.rb
 - lib/brakeman/report/ignore/config.rb
 - lib/brakeman/report/ignore/interactive.rb
 - lib/brakeman/report/initializers/faster_csv.rb
@@ -320,6 +283,7 @@ files:
 - lib/brakeman/report/templates/template_overview.html.erb
 - lib/brakeman/report/templates/view_warnings.html.erb
 - lib/brakeman/report/templates/warning_overview.html.erb
+- lib/brakeman/report.rb
 - lib/brakeman/rescanner.rb
 - lib/brakeman/scanner.rb
 - lib/brakeman/tracker.rb
@@ -327,30 +291,32 @@ files:
 - lib/brakeman/version.rb
 - lib/brakeman/warning.rb
 - lib/brakeman/warning_codes.rb
+- lib/brakeman.rb
 - lib/ruby_parser/bm_sexp.rb
 - lib/ruby_parser/bm_sexp_processor.rb
 homepage: http://brakemanscanner.org
 licenses:
 - MIT
-metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 1.8.9
 signing_key: 
-specification_version: 4
+specification_version: 3
 summary: Security vulnerability scanner for Ruby on Rails.
 test_files: []

checksums.yaml

@@ -1,15 +0,0 @@
----
-!binary "U0hBMQ==":
-  metadata.gz: !binary |-
-    MTMyMjhjZTg2NjUzNjM4Zjg4MjkxMDY3YjljM2RlMzYxNDE1MTcwMg==
-  data.tar.gz: !binary |-
-    ODU3OTE0NjFjODgzZWRlODMyZDViZTQwNjUzYTQ0MzNhZjEzNjMyYQ==
-SHA512:
-  metadata.gz: !binary |-
-    YTAzY2FlZWRiZTYwODMwZmQ5YmQ2YTI3M2VjMmJjMTM3Y2YxNDM5NDU3MDYw
-    ODJlMGNiYWM0ZDExYzU3NjI1NzY4ZWE2ZDg1MTQ2NzBiYTJkM2E4YzMwNWUw
-    OGVhYjU5ZDk0MzY4Njk2MzhmYzk0NGQ1YWEzNWFmMzUzMGY5MzA=
-  data.tar.gz: !binary |-
-    YmVmZTkxZTQxZDNmODJkNGMyYmE2NDdkNDI1Yjk1NmRlNjlhZGRmYjgzZjY0
-    NGVhZDYwZGM1MWQ5MGYxMDQ4MWNmNWIxOTkwMDgxNWI3YTIzYjQ0OTQ3ODZk
-    MmU2ZTI5YWE3YjQ2OTczMTg3M2NiZWUxYjIxMjhiZWM4NjhhMWY=