railroader 4.3.7 → 4.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7f3e3d1142109902243a69df249c4914e374a904da6b861d89ce89e581a6a1e2
-  data.tar.gz: cea84ff58d67cae53ac7d3e754a8f61115ad6db779078d4e46ef0dffe0f6b5c8
+  metadata.gz: 63c5753f1d828b85647b29a336f2e1a7b546a3daf1059ae3779bb539ec87f59e
+  data.tar.gz: 92e322786b4fcb354700bbde88384aada983108663988a041a772a2311eb333c
 SHA512:
-  metadata.gz: 22d88d8de4ddb0aae8b402309dd73f495780ed4134f9ba098a1fe8e0c21751b2119103470dd3f4d4a3998438c4faa7858e41c4e2cb6f6cab19814b2472438d51
-  data.tar.gz: bd58f1f7d270a32ea5720b009418d7f49c3179b9c8a4837faa1ba56ae4449b4fe4bbfb0bf6f2c20c650d4b05312302c272489735e80c1e2b080e2796faf87957
+  metadata.gz: 2a3b22e608487251cd6f9d6a5c03566f946d9a93e7ead6dc11980c4448c2c9806cf94d750d8e722d7f455e08fec6515ca40f24185fce37a4e9d80899be3ac663
+  data.tar.gz: 9b8a383e9ff2221731ee53b98d31986b6ca8b630ba8db43958146f6f89679e6269e25558482db407636f8e8aa84dd94597b222fa31b968c6c85954bc075398fe

data/CHANGES.md

@@ -1,3 +1,13 @@
+# 4.3.8
+
+* Temporarily prevent use of `sexp_processor` version 4.12.1,
+  because it causes an error at
+  `lib/railroader/processors/alias_processor.rb:50:in process_safely'`.
+  We want to get back to working order quickly, and we can then
+  fix things more leisurely.
+* Various code cleanups, trying to make the code easier to read.
+
+
 # 4.3.7
 
 * We earned a CII Best Practices badge!  Show its badge on the README.
@@ -5,7 +15,7 @@
 * Add information on how to report vulnerabilities in the Railroader
   application itself.
 * Update `ruby_parser` to version 3.13.1. This improves and fixes handling of
-  some Ruby constructs, but it also means that we now longer support
+  some Ruby constructs, but it also means that we no longer support
   running on Ruby 1.9.  The last branch of Ruby 1.9 (1.9.3)
   ended all support on 23 Feb 2015, after a one-year warning, per:
   https://www.ruby-lang.org/en/news/2015/02/23/support-for-ruby-1-9-3-has-ended/
@@ -13,6 +23,9 @@
   4 years after support ended, we think this is reasonable.
   If you really need to run something on Ruby 1.9, forcibly select
   an older version of Railroader such as 4.3.5.
+  It would be possible to support Ruby 1.9 with some extra effort,
+  so I've left in a number of stubs for handling Ruby 1.9 in case we do so.
+  I suspect we won't bother, but patches welcome.
 
 # 4.3.5
 

data/README.md

@@ -3,6 +3,7 @@
 [![Build Status](https://travis-ci.org/david-a-wheeler/railroader.svg?branch=master)](https://travis-ci.org/david-a-wheeler/railroader)
 [![Maintainability](https://api.codeclimate.com/v1/badges/1b08a5c74695cb0d11ec/maintainability)](https://codeclimate.com/github/david-a-wheeler/railroader/maintainability)
 [![Test Coverage](https://api.codeclimate.com/v1/badges/1b08a5c74695cb0d11ec/test_coverage)](https://codeclimate.com/github/david-a-wheeler/railroader/test_coverage)
+[![License](https://img.shields.io/:license-mit-blue.svg)](https://badges.mit-license.org)
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/2514/badge)](https://bestpractices.coreinfrastructure.org/projects/2514)
 <!-- [![Gitter](https://badges.gitter.im/david-a-wheeler/railroader.svg)](https://gitter.im/david-a-wheeler/railroader) -->
 

data/lib/railroader/checks/check_content_tag.rb

@@ -20,12 +20,12 @@ class Railroader::CheckContentTag < Railroader::CheckCrossSiteScripting
 
   def run_check
     @ignore_methods = Set[:button_to, :check_box, :escapeHTML, :escape_once,
-                           :field_field, :fields_for, :h, :hidden_field,
-                           :hidden_field, :hidden_field_tag, :image_tag, :label,
-                           :mail_to, :radio_button, :select,
-                           :submit_tag, :text_area, :text_field,
-                           :text_field_tag, :url_encode, :u, :url_for,
-                           :will_paginate].merge tracker.options[:safe_methods]
+                          :field_field, :fields_for, :h, :hidden_field,
+                          :hidden_field, :hidden_field_tag, :image_tag, :label,
+                          :mail_to, :radio_button, :select,
+                          :submit_tag, :text_area, :text_field,
+                          :text_field_tag, :url_encode, :u, :url_for,
+                          :will_paginate].merge tracker.options[:safe_methods]
 
     @known_dangerous = []
     @content_tags = tracker.find_call :target => false, :method => :content_tag

data/lib/railroader/checks/check_cross_site_scripting.rb

@@ -282,12 +282,12 @@ class Railroader::CheckCrossSiteScripting < Railroader::BaseCheck
 
   def setup
     @ignore_methods = Set[:==, :!=, :button_to, :check_box, :content_tag, :escapeHTML, :escape_once,
-                           :field_field, :fields_for, :h, :hidden_field,
-                           :hidden_field, :hidden_field_tag, :image_tag, :label,
-                           :link_to, :mail_to, :radio_button, :select,
-                           :submit_tag, :text_area, :text_field,
-                           :text_field_tag, :url_encode, :u, :url_for,
-                           :will_paginate].merge tracker.options[:safe_methods]
+                          :field_field, :fields_for, :h, :hidden_field,
+                          :hidden_field, :hidden_field_tag, :image_tag, :label,
+                          :link_to, :mail_to, :radio_button, :select,
+                          :submit_tag, :text_area, :text_field,
+                          :text_field_tag, :url_encode, :u, :url_for,
+                          :will_paginate].merge tracker.options[:safe_methods]
 
     @models = tracker.models.keys
     @inspect_arguments = tracker.options[:check_arguments]

data/lib/railroader/checks/check_execute.rb

@@ -14,9 +14,9 @@ class Railroader::CheckExecute < Railroader::BaseCheck
   @description = "Finds instances of possible command injection"
 
   SAFE_VALUES = [s(:const, :RAILS_ROOT),
-                  s(:call, s(:const, :Rails), :root),
-                  s(:call, s(:const, :Rails), :env),
-                  s(:call, s(:const, :Process), :pid)]
+                 s(:call, s(:const, :Rails), :root),
+                 s(:call, s(:const, :Rails), :env),
+                 s(:call, s(:const, :Process), :pid)]
 
   SHELL_ESCAPES = [:escape, :shellescape, :join]
 
@@ -32,8 +32,8 @@ class Railroader::CheckExecute < Railroader::BaseCheck
     Railroader.debug "Finding other system calls"
     calls = tracker.find_call :targets => [:IO, :Open3, :Kernel, :'POSIX::Spawn', :Process, nil],
       :methods => [:capture2, :capture2e, :capture3, :exec, :pipeline, :pipeline_r,
-        :pipeline_rw, :pipeline_start, :pipeline_w, :popen, :popen2, :popen2e,
-        :popen3, :spawn, :syscall, :system], :nested => true
+                   :pipeline_rw, :pipeline_start, :pipeline_w, :popen, :popen2, :popen2e,
+                   :popen3, :spawn, :syscall, :system], :nested => true
 
     Railroader.debug "Processing system calls"
     calls.each do |result|

data/lib/railroader/checks/check_link_to.rb

@@ -13,12 +13,12 @@ class Railroader::CheckLinkTo < Railroader::CheckCrossSiteScripting
     return unless version_between?("2.0.0", "2.9.9") and not tracker.config.escape_html?
 
     @ignore_methods = Set[:button_to, :check_box, :escapeHTML, :escape_once,
-                           :field_field, :fields_for, :h, :hidden_field,
-                           :hidden_field, :hidden_field_tag, :image_tag, :label,
-                           :mail_to, :radio_button, :select,
-                           :submit_tag, :text_area, :text_field,
-                           :text_field_tag, :url_encode, :u, :url_for,
-                           :will_paginate].merge tracker.options[:safe_methods]
+                          :field_field, :fields_for, :h, :hidden_field,
+                          :hidden_field, :hidden_field_tag, :image_tag, :label,
+                          :mail_to, :radio_button, :select,
+                          :submit_tag, :text_area, :text_field,
+                          :text_field_tag, :url_encode, :u, :url_for,
+                          :will_paginate].merge tracker.options[:safe_methods]
 
     @known_dangerous = []
     # Ideally, I think this should also check to see if people are setting

data/lib/railroader/checks/check_link_to_href.rb

@@ -13,12 +13,12 @@ class Railroader::CheckLinkToHref < Railroader::CheckLinkTo
 
   def run_check
     @ignore_methods = Set[:button_to, :check_box,
-                           :field_field, :fields_for, :hidden_field,
-                           :hidden_field, :hidden_field_tag, :image_tag, :label,
-                           :mail_to, :polymorphic_url, :radio_button, :select, :slice,
-                           :submit_tag, :text_area, :text_field,
-                           :text_field_tag, :url_encode, :u,
-                           :will_paginate].merge(tracker.options[:url_safe_methods] || [])
+                          :field_field, :fields_for, :hidden_field,
+                          :hidden_field, :hidden_field_tag, :image_tag, :label,
+                          :mail_to, :polymorphic_url, :radio_button, :select, :slice,
+                          :submit_tag, :text_area, :text_field,
+                          :text_field_tag, :url_encode, :u,
+                          :will_paginate].merge(tracker.options[:url_safe_methods] || [])
 
     @models = tracker.models.keys
     @inspect_arguments = tracker.options[:check_arguments]

data/lib/railroader/checks/check_mass_assignment.rb

@@ -35,19 +35,14 @@ class Railroader::CheckMassAssignment < Railroader::BaseCheck
     return [] if models.empty?
 
     Railroader.debug "Finding possible mass assignment calls on #{models.length} models"
-    @mass_assign_calls = tracker.find_call :chained => true, :targets => models, :methods => [:new,
-      :attributes=,
-      :update_attributes,
-      :update_attributes!,
-      :create,
-      :create!,
-      :build,
-      :first_or_create,
-      :first_or_create!,
-      :first_or_initialize!,
-      :assign_attributes,
-      :update
-    ]
+    @mass_assign_calls = tracker.find_call :chained => true,
+       :targets => models,
+       :methods => [
+                     :new, :attributes=, :update_attributes,
+                     :update_attributes!, :create, :create!, :build,
+                     :first_or_create, :first_or_create!,
+                     :first_or_initialize!, :assign_attributes, :update
+       ]
   end
 
   def check_mass_assignment

data/lib/railroader/checks/check_sql.rb

@@ -30,7 +30,7 @@ class Railroader::CheckSQL < Railroader::BaseCheck
     end
 
     @connection_calls = [:delete, :execute, :insert, :select_all, :select_one,
-      :select_rows, :select_value, :select_values]
+                         :select_rows, :select_value, :select_values]
 
     if tracker.options[:rails3]
       @connection_calls.concat [:exec_delete, :exec_insert, :exec_query, :exec_update]
@@ -574,11 +574,11 @@ class Railroader::CheckSQL < Railroader::BaseCheck
   end
 
   IGNORE_METHODS_IN_SQL = Set[:id, :merge_conditions, :table_name, :quoted_table_name,
-    :quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array,
-    :sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
-    :sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
-    :to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
-    :where_values_hash, :foreign_key
+                              :quoted_primary_key, :to_i, :to_f, :sanitize_sql, :sanitize_sql_array,
+                              :sanitize_sql_for_assignment, :sanitize_sql_for_conditions, :sanitize_sql_hash,
+                              :sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions,
+                              :to_sql, :sanitize, :primary_key, :table_name_prefix, :table_name_suffix,
+                              :where_values_hash, :foreign_key
   ]
 
   def safe_value? exp

data/lib/railroader/checks/check_without_protection.rb

@@ -17,12 +17,11 @@ class Railroader::CheckWithoutProtection < Railroader::BaseCheck
     return if active_record_models.empty?
 
     Railroader.debug "Finding all mass assignments"
-    calls = tracker.find_call :targets => active_record_models.keys, :methods => [:new,
-      :attributes=,
-      :update_attributes,
-      :update_attributes!,
-      :create,
-      :create!]
+    calls = tracker.find_call :targets => active_record_models.keys,
+      :methods => [
+        :new, :attributes=, :update_attributes, :update_attributes!,
+        :create, :create!
+      ]
 
     Railroader.debug "Processing all mass assignments"
     calls.each do |result|

data/lib/railroader/options.rb

@@ -204,9 +204,9 @@ module Railroader::Options
         end
 
         opts.on "-f",
-          "--format TYPE",
-          [:pdf, :text, :html, :csv, :tabs, :json, :markdown, :codeclimate, :cc, :plain, :table],
-          "Specify output formats. Default is text" do |type|
+                "--format TYPE",
+                [:pdf, :text, :html, :csv, :tabs, :json, :markdown, :codeclimate, :cc, :plain, :table],
+                "Specify output formats. Default is text" do |type|
 
           type = "s" if type == :text
           options[:output_format] = ("to_" << type.to_s).to_sym
@@ -282,9 +282,9 @@ module Railroader::Options
         end
 
         opts.on "-w",
-          "--confidence-level LEVEL",
-          ["1", "2", "3"],
-          "Set minimal confidence level (1 - 3)" do |level|
+                "--confidence-level LEVEL",
+                ["1", "2", "3"],
+                "Set minimal confidence level (1 - 3)" do |level|
 
           options[:min_confidence] =  3 - level.to_i
         end

data/lib/railroader/processors/alias_processor.rb

@@ -670,11 +670,11 @@ class Railroader::AliasProcessor < Railroader::SexpProcessor
 
     if @tracker
       @tracker.add_constant exp.lhs,
-        exp.rhs,
-        :file => current_file_name,
-        :module => @current_module,
-        :class => @current_class,
-        :method => @current_method
+                            exp.rhs,
+                            :file => current_file_name,
+                            :module => @current_module,
+                            :class => @current_class,
+                            :method => @current_method
     end
 
     if exp.lhs.is_a? Symbol

data/lib/railroader/processors/base_processor.rb

@@ -181,11 +181,11 @@ class Railroader::BaseProcessor < Railroader::SexpProcessor
   def process_cdecl exp
     if @tracker
       @tracker.add_constant exp.lhs,
-        exp.rhs,
-        :file => current_file_name,
-        :module => @current_module,
-        :class => @current_class,
-        :method => @current_method
+                            exp.rhs,
+                            :file => current_file_name,
+                            :module => @current_module,
+                            :class => @current_class,
+                            :method => @current_method
     end
 
     exp

data/lib/railroader/report/report_html.rb

@@ -2,8 +2,8 @@ require 'cgi'
 
 class Railroader::Report::HTML < Railroader::Report::Base
   HTML_CONFIDENCE = [ "<span class='high-confidence'>High</span>",
-    "<span class='med-confidence'>Medium</span>",
-    "<span class='weak-confidence'>Weak</span>" ]
+                      "<span class='med-confidence'>Medium</span>",
+                      "<span class='weak-confidence'>Weak</span>" ]
 
   def initialize *args
     super

data/lib/railroader/report/report_tabs.rb

@@ -3,7 +3,7 @@
 class Railroader::Report::Tabs < Railroader::Report::Base
   def generate_report
     [[:generic_warnings, "General"], [:controller_warnings, "Controller"],
-      [:model_warnings, "Model"], [:template_warnings, "Template"]].map do |meth, category|
+     [:model_warnings, "Model"], [:template_warnings, "Template"]].map do |meth, category|
 
       self.send(meth).map do |w|
         line = w.line || 0

data/lib/railroader/rescanner.rb

@@ -7,7 +7,7 @@ class Railroader::Rescanner < Railroader::Scanner
  include Railroader::Util
   KNOWN_TEMPLATE_EXTENSIONS = Railroader::TemplateParser::KNOWN_TEMPLATE_EXTENSIONS
   SCAN_ORDER = [:config, :gemfile, :initializer, :lib, :routes, :template,
-    :model, :controller]
+                :model, :controller]
 
   # Create new Rescanner to scan changed files
   def initialize options, processor, changed_files

data/lib/railroader/tracker.rb

@@ -10,9 +10,9 @@ require 'railroader/tracker/constants'
 # The Tracker keeps track of all the processed information.
 class Railroader::Tracker
   attr_accessor :controllers, :constants, :templates, :models, :errors,
-    :checks, :initializers, :config, :routes, :processor, :libs,
-    :template_cache, :options, :filter_cache, :start_time, :end_time,
-    :duration, :ignored_filter
+                :checks, :initializers, :config, :routes, :processor, :libs,
+                :template_cache, :options, :filter_cache, :start_time, :end_time,
+                :duration, :ignored_filter
 
   # Place holder when there should be a model, but it is not
   # clear what model it will be.

data/lib/railroader/version.rb

@@ -1,3 +1,3 @@
 module Railroader
-  Version = "4.3.7"
+  Version = "4.3.8"
 end

data/lib/railroader/warning.rb

@@ -5,8 +5,8 @@ require 'railroader/warning_codes'
 # The Warning class stores information about warnings
 class Railroader::Warning
   attr_reader :called_from, :check, :class, :confidence, :controller,
-    :line, :method, :model, :template, :user_input, :user_input_type,
-    :warning_code, :warning_set, :warning_type
+              :line, :method, :model, :template, :user_input, :user_input_type,
+              :warning_code, :warning_set, :warning_type
 
   attr_accessor :code, :context, :file, :message, :relative_path
 

data/lib/ruby_parser/bm_sexp.rb

@@ -597,10 +597,10 @@ end
 
 # Invalidate hash cache if the Sexp changes
 [:[]=, :clear, :collect!, :compact!, :concat, :delete, :delete_at,
-  :delete_if, :drop, :drop_while, :fill, :flatten!, :replace, :insert,
-  :keep_if, :map!, :pop, :push, :reject!, :replace, :reverse!, :rotate!,
-  :select!, :shift, :shuffle!, :slice!, :sort!, :sort_by!, :transpose,
-  :uniq!, :unshift].each do |method|
+ :delete_if, :drop, :drop_while, :fill, :flatten!, :replace, :insert,
+ :keep_if, :map!, :pop, :push, :reject!, :replace, :reverse!, :rotate!,
+ :select!, :shift, :shuffle!, :slice!, :sort!, :sort_by!, :transpose,
+ :uniq!, :unshift].each do |method|
 
   Sexp.class_eval <<-RUBY
     def #{method} *args

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: railroader
 version: !ruby/object:Gem::Version
-  version: 4.3.7
+  version: 4.3.8
 platform: ruby
 authors:
 - David A. Wheeler and Justin Collins
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain:
 - railroader-public_cert.pem
-date: 2019-05-11 00:00:00.000000000 Z
+date: 2019-06-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby_parser
@@ -32,6 +32,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4.7'
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 4.12.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -39,6 +42,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4.7'
+    - - "!="
+      - !ruby/object:Gem::Version
+        version: 4.12.1
 - !ruby/object:Gem::Dependency
   name: ruby2ruby
   requirement: !ruby/object:Gem::Requirement