pronto-brakeman 0.9.0 → 0.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 67abc178603d684561603dd2f90cbc192866f881
-  data.tar.gz: 41bb50779dbfcf0013eb590b74af5ebe153f26ae
+SHA256:
+  metadata.gz: cab70317e2e7947ea734fd71d2068ce514b9c9cbe5abafd31c0afd47f1dfeb8c
+  data.tar.gz: 69b0a138c4db8c02fd51bf5d55ac311e21b4dc153e8d200f6d150b53629aeb75
 SHA512:
-  metadata.gz: bebd7595638dbb5854ee8a144bf0b92d4153b13ac1342857ecce189f98fade14243b6d9db1922c10762791eab6a8cd8cc9aee3b22b60e798dcd41bc1974a884f
-  data.tar.gz: 01de7b0abf4bed57c8106ea9662c43980694281a637f1a06d21acfa4ac841e646871fd3584d359f2f9856b79ff793eaafbd6e73f13296021b9b022aa1e53b816
+  metadata.gz: 979f1c9c6ee6dd53b12334e38fb83fd81b203f0930dd7645a07d255de7e25dab31d43468273511b08d913e59fb80b66e8d5842537e90efb09ea04d674369cd10
+  data.tar.gz: 1de572cc71827b47ff58c376a52f0c585ef185540d7ec3c7e21becaacc7d73e61e725efc71894fb1ff2cd983c24fb294522c90955759534b004e7683c0e97776

data/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Order is important. The last matching pattern takes the most precedence.
+# Default owners for everything in the repo.
+* @prontolabs/core

data/.github/workflows/checks.yml

@@ -0,0 +1,24 @@
+name: Checks
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  ruby:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby: ['2.5', '2.6', '2.7', '3.0']
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        fetch-depth: 0 # required for "not a rails app" spec
+    - uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby }}
+        bundler-cache: true
+    - name: rake spec
+      run: bundle exec rake spec

data/README.md

@@ -1,14 +1,24 @@
 # Pronto runner for Brakeman
 
-[![Code Climate](https://codeclimate.com/github/mmozuras/pronto-brakeman.png)](https://codeclimate.com/github/mmozuras/pronto-brakeman)
-[![Build Status](https://travis-ci.org/mmozuras/pronto-brakeman.png)](https://travis-ci.org/mmozuras/pronto-brakeman)
+[![Code Climate](https://codeclimate.com/github/prontolabs/pronto-brakeman.png)](https://codeclimate.com/github/prontolabs/pronto-brakeman)
+[![Build Status](https://github.com/prontolabs/pronto-brakeman/actions/workflows/checks.yml/badge.svg)](https://github.com/prontolabs/pronto-brakeman/actions/workflows/checks.yml)
 [![Gem Version](https://badge.fury.io/rb/pronto-brakeman.png)](http://badge.fury.io/rb/pronto-brakeman)
-[![Dependency Status](https://gemnasium.com/mmozuras/pronto-brakeman.png)](https://gemnasium.com/mmozuras/pronto-brakeman)
 
-Pronto runner for [Brakeman](https://github.com/presidentbeef/brakeman), security vulnerability scanner for RoR. [What is Pronto?](https://github.com/mmozuras/pronto)
+Pronto runner for [Brakeman](https://github.com/presidentbeef/brakeman), security vulnerability scanner for RoR. [What is Pronto?](https://github.com/prontolabs/pronto)
 
 ## Severity mapping
 
 Brakeman [Confidence](https://github.com/presidentbeef/brakeman#confidence-levels) is mapped to severity levels on the
 messages generated by Pronto. High confidence maps to fatal, medium confidence maps to warning, and low confidence maps
 to info.
+
+## Run all checks
+
+Brakeman also includes some optional checks and by setting the following in your `.pronto.yml` you can run every check included in the gem:
+
+```yaml
+brakeman:
+  run_all_checks: true
+```
+
+(This is the equivalent of running `brakeman -A` on the command line.)

data/lib/pronto/brakeman/version.rb

@@ -1,5 +1,5 @@
 module Pronto
   module BrakemanVersion
-    VERSION = '0.9.0'.freeze
+    VERSION = '0.11.1'.freeze
   end
 end

data/lib/pronto/brakeman.rb

@@ -4,23 +4,25 @@ require 'brakeman'
 module Pronto
   class Brakeman < Runner
     def run
-      files = ruby_patches.map do |patch|
+      patches = ruby_patches | erb_patches
+      files = patches.map do |patch|
         patch.new_file_full_path.relative_path_from(repo_path).to_s
-      end
+      end.sort
 
       return [] unless files.any?
 
       output = ::Brakeman.run(app_path: repo_path,
                               output_formats: [:to_s],
-                              only_files: files)
-      messages_for(ruby_patches, output).compact
+                              only_files: files,
+                              run_all_checks: run_all_checks?)
+       messages_for(patches, output).compact
     rescue ::Brakeman::NoApplication
       []
     end
 
-    def messages_for(ruby_patches, output)
+    def messages_for(code_patches, output)
       output.filtered_warnings.map do |warning|
-        patch = patch_for_warning(ruby_patches, warning)
+        patch = patch_for_warning(code_patches, warning)
 
         next unless patch
         line = patch.added_lines.find do |added_line|
@@ -34,7 +36,7 @@ module Pronto
     def new_message(line, warning)
       Message.new(line.patch.delta.new_file[:path], line,
                   severity_for_confidence(warning.confidence),
-                  "Possible security vulnerability: #{warning.message}",
+                  "Possible security vulnerability: [#{warning.message}](#{warning.link})",
                   nil, self.class)
     end
 
@@ -49,10 +51,27 @@ module Pronto
       end
     end
 
-    def patch_for_warning(ruby_patches, warning)
-      ruby_patches.find do |patch|
-        patch.new_file_full_path.to_s == warning.file
+    def patch_for_warning(code_patches, warning)
+      code_patches.find do |patch|
+        patch.new_file_full_path.to_s == warning.file.absolute
       end
     end
+
+    def run_all_checks?
+      pronto_brakeman_config['run_all_checks']
+    end
+
+    def pronto_brakeman_config
+      pronto_brakeman_config ||= Pronto::ConfigFile.new.to_h['brakeman'] || {}
+    end
+
+    def erb_patches
+      @erb_patches ||= Array(@patches).select { |patch| patch.additions > 0 }
+                                      .select { |patch| erb_file?(patch.new_file_full_path) }
+    end
+
+    def erb_file?(path)
+      File.extname(path) == '.erb'
+    end
   end
 end

data/pronto-brakeman.gemspec

@@ -14,7 +14,7 @@ Gem::Specification.new do |s|
   s.summary = 'Pronto runner for Brakeman, security vulnerability scanner for RoR'
 
   s.licenses = ['MIT']
-  s.required_ruby_version = '>= 2.0.0'
+  s.required_ruby_version = '>= 2.5.0'
   s.rubygems_version = '1.8.23'
 
   s.files = `git ls-files`.split($RS).reject do |file|
@@ -32,8 +32,8 @@ Gem::Specification.new do |s|
   s.extra_rdoc_files = ['LICENSE', 'README.md']
   s.require_paths = ['lib']
 
-  s.add_runtime_dependency('pronto', '~> 0.9.0')
-  s.add_runtime_dependency('brakeman', '~> 3.2', '>= 3.2.0')
+  s.add_runtime_dependency('pronto', '~> 0.11.0')
+  s.add_runtime_dependency('brakeman', '>= 3.2.0')
   s.add_development_dependency('rake', '~> 12.0')
   s.add_development_dependency('rspec', '~> 3.4')
   s.add_development_dependency('rspec-its', '~> 1.2')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pronto-brakeman
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.11.1
 platform: ruby
 authors:
 - Mindaugas Mozūras
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-04-23 00:00:00.000000000 Z
+date: 2021-12-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: pronto
@@ -16,21 +16,18 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.0
+        version: 0.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.9.0
+        version: 0.11.0
 - !ruby/object:Gem::Dependency
   name: brakeman
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.2.0
@@ -38,9 +35,6 @@ dependencies:
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.2.0
@@ -94,6 +88,8 @@ extra_rdoc_files:
 - LICENSE
 - README.md
 files:
+- ".github/CODEOWNERS"
+- ".github/workflows/checks.yml"
 - LICENSE
 - README.md
 - lib/pronto/brakeman.rb
@@ -111,15 +107,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.0.0
+      version: 2.5.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.10
+rubygems_version: 3.2.5
 signing_key: 
 specification_version: 4
 summary: Pronto runner for Brakeman, security vulnerability scanner for RoR