brakeman 8.0.2 → 8.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 408455132c50dab2b913428c4532b12e5ef60cd3343935a1b505c8b539b2d5e6
-  data.tar.gz: 86e837f136df2a3916b4288c0f32191b0ac2379b0b90a73286fa0cf2d0aca714
+  metadata.gz: a395362f80d7745fcc8ce87d26fd44b3d14b2fac87f018dbb08cc9ef7d8c9a49
+  data.tar.gz: 5bc7d3e269e9616b1c8e529717134898fedc8d80898a7e9ae64fab53f9c4050c
 SHA512:
-  metadata.gz: c56c3b0598eade85878e6004b49cc6eb5ecc7be6bd011a7d11c1b462192c161d6afc38e2d50b2c088aba0a4ab55c89b4f01d740e6dbf4d84e2276c9cab541415
-  data.tar.gz: b08b76a3d45559215cf5a9d288f9561d25dccd233803346d0a783c36decb9ebba4b8e2c665775cee21fc31b6a60126fb79ea9c98ffdc4d24c9eb2502abfab401
+  metadata.gz: d3d573fb08637217d7fa63b39d7540b205d6a8372f4b5b71646879067051dacd8407ae1d41134db54d342f0d2d7b4e16fcf7f2f9639244a77a07c38247c08dd0
+  data.tar.gz: a6c649141045ff4a25fc6fd72d0381bb8197bb8898a0978319a11fa17c7e9ab75c4ea553ee34ea564906a9f7e29503b6c75197d5edc30c7387ccc679a1a87480

data/CHANGES.md

@@ -1,3 +1,10 @@
+# 8.0.3 - 2026-02-26
+
+* Fix `polymorphic_name` SQLi false positive (Fredrico Franco)
+* Fix logger behavior when loading config files
+* Handle application names with module prefixes
+* Add release age option for `--ensure-latest`
+
 # 8.0.2 - 2026-02-03
 
 * Reline console control should use stderr

data/lib/brakeman/checks/check_sql.rb

@@ -600,7 +600,8 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
     :sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
     :sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
     :to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
-    :where_values_hash, :foreign_key, :uuid, :escape, :escape_string
+    :where_values_hash, :foreign_key, :uuid, :escape, :escape_string,
+    :polymorphic_name
   ]
 
   def ignore_methods_in_sql

data/lib/brakeman/commandline.rb

@@ -31,7 +31,7 @@ module Brakeman
         set_interrupt_handler options
         early_exit_options options
         set_options options, default_app_path
-        check_latest if options[:ensure_latest]
+        check_latest(options[:ensure_latest]) if options[:ensure_latest]
         run_report options
 
         quit
@@ -39,9 +39,14 @@ module Brakeman
 
       # Check for the latest version.
       #
-      # If the latest version is newer, quit with a message.
-      def check_latest
-        if error = Brakeman.ensure_latest
+      # If the latest version is newer than the current version
+      # and age, exit.
+      def check_latest(days_old = 0)
+        if days_old == true
+          days_old = 0
+        end
+
+        if error = Brakeman.ensure_latest(days_old:)
           quit Brakeman::Not_Latest_Version_Exit_Code, error
         end
       end

data/lib/brakeman/options.rb

@@ -63,8 +63,12 @@ module Brakeman::Options
           options[:exit_on_error] = exit_on_error
         end
 
-        opts.on "--ensure-latest", "Fail when Brakeman is outdated" do
-          options[:ensure_latest] = true
+        opts.on "--ensure-latest [DAYS]", Integer, "Fail when Brakeman is outdated. Optionally set minimum age in days." do |days|
+          if days and not (1..15).include? days
+            raise OptionParser::InvalidArgument
+          end
+
+          options[:ensure_latest] = days || true
         end
 
         opts.on "--ensure-ignore-notes", "Fail when an ignored warnings does not include a note" do

data/lib/brakeman/processors/lib/rails3_config_processor.rb

@@ -17,6 +17,7 @@ require 'brakeman/processors/lib/basic_processor'
 #Values for tracker.config.rails will still be Sexps.
 class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
   RAILS_CONFIG = Sexp.new(:call, nil, :config)
+  RAILS_APPLICATION = Sexp.new(:colon2, s(:const, :Rails), :Application)
 
   def initialize *args
     super
@@ -48,7 +49,7 @@ class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
 
   #Look for class Application < Rails::Application
   def process_class exp
-    if exp.class_name == :Application
+    if application_class? exp
       @inside_config = true
       process_all exp.body if sexp? exp.body
       @inside_config = false
@@ -57,6 +58,14 @@ class Brakeman::Rails3ConfigProcessor < Brakeman::BasicProcessor
     exp
   end
 
+  def application_class? exp
+    return unless node_type? exp, :class
+
+    exp.class_name == :Application or
+    (node_type? exp.class_name, :colon2 and exp.class_name.rhs == :Application) or
+    (exp.parent_name == RAILS_APPLICATION)
+  end
+
   #Look for configuration settings that
   #are just a call like
   #

data/lib/brakeman/version.rb

@@ -1,3 +1,3 @@
 module Brakeman
-  Version = "8.0.2"
+  Version = "8.0.3"
 end

data/lib/brakeman.rb

@@ -167,7 +167,6 @@ module Brakeman
   #Load options from YAML file
   def self.load_options line_options
     custom_location = line_options[:config_file]
-    quiet = line_options[:quiet]
     app_path = line_options[:app_path]
 
     #Load configuration file
@@ -175,29 +174,28 @@ module Brakeman
       require 'yaml'
       options = YAML.safe_load_file config, permitted_classes: [Symbol], symbolize_names: true
 
-      # Brakeman.logger is probably not set yet
-      logger = Brakeman::Logger.get_logger(options || line_options)
-
       if options
         options.each { |k, v| options[k] = Set.new v if v.is_a? Array }
 
         # After parsing the yaml config file for options, convert any string keys into symbols.
         options.keys.select {|k| k.is_a? String}.map {|k| k.to_sym }.each {|k| options[k] = options[k.to_s]; options.delete(k.to_s) }
 
+        # Brakeman.logger is probably not set yet
+        logger = Brakeman::Logger.get_logger(options.merge(line_options))
+
         unless line_options[:allow_check_paths_in_config]
           if options.include? :additional_checks_path
             options.delete :additional_checks_path
 
-            logger.alert 'Ignoring additional check paths in config file. Use --allow-check-paths-in-config to allow' unless (options[:quiet] || quiet)
+            logger.alert 'Ignoring additional check paths in config file. Use --allow-check-paths-in-config to allow'
           end
         end
 
-        # notify if options[:quiet] and quiet is nil||false
-        # potentially remove these checks now that logger is used
-        logger.alert "Using configuration in #{config}" unless (options[:quiet] || quiet)
+        logger.alert "Using configuration in #{config}"
         options
       else
-        logger.alert "Empty configuration file: #{config}" unless quiet
+        logger = Brakeman::Logger.get_logger(line_options)
+        logger.alert "Empty configuration file: #{config}"
         {}
       end
     else
@@ -416,11 +414,25 @@ module Brakeman
     end
   end
 
-  def self.ensure_latest
+  # Returns quit message unless the latest version
+  # of Brakeman matches the current version.
+  #
+  # Optionally checks that the latest version is at least
+  # the specified number of days old.
+  def self.ensure_latest(days_old: 0)
     current = Brakeman::Version
-    latest = Gem.latest_version_for('brakeman').to_s
-    if current != latest
-      "Brakeman #{current} is not the latest version #{latest}"
+    latest = Gem.latest_spec_for('brakeman')
+    release_date = latest.date.to_date
+    latest_version = latest.version.to_s
+
+    if (Date.today - latest.date.to_date) >= days_old
+      if current != latest_version
+        return "Brakeman #{current} is not the latest version #{latest_version}"
+      else
+        false
+      end
+    else
+      false
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: brakeman
 version: !ruby/object:Gem::Version
-  version: 8.0.2
+  version: 8.0.3
 platform: ruby
 authors:
 - Justin Collins
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-03 00:00:00.000000000 Z
+date: 2026-02-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: racc
@@ -700,7 +700,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: Security vulnerability scanner for Ruby on Rails.