Class: Brakeman::Scanner
Overview
Scans the Rails application.
Direct Known Subclasses
Constant Summary collapse
- RUBY_1_9 =
!!(RUBY_VERSION >= "1.9.0")
- KNOWN_TEMPLATE_EXTENSIONS =
/.*\.(erb|haml|rhtml|slim)$/
Instance Attribute Summary collapse
-
#options ⇒ Object
readonly
Returns the value of attribute options.
Instance Method Summary collapse
- #index_call_sites ⇒ Object
-
#initialize(options, processor = nil) ⇒ Scanner
constructor
Pass in path to the root of the Rails application.
- #parse_ruby(input) ⇒ Object
-
#process ⇒ Object
Process everything in the Rails application.
-
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb.
- #process_controller(path) ⇒ Object
-
#process_controllers ⇒ Object
Process all .rb files in controllers/.
-
#process_gems ⇒ Object
Process Gemfile.
-
#process_initializer(path) ⇒ Object
Process an initializer.
-
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/.
-
#process_lib(path) ⇒ Object
Process a library.
-
#process_libs ⇒ Object
Process all .rb in lib/.
- #process_model(path) ⇒ Object
-
#process_models ⇒ Object
Process all the .rb files in models/.
-
#process_routes ⇒ Object
Process config/routes.rb.
- #process_template(path) ⇒ Object
-
#process_templates ⇒ Object
Process all views and partials in views/.
- #report_progress(current, total, type = "files") ⇒ Object
-
#template_path_to_name(path) ⇒ Object
Convert path/filename to view name.
-
#tracker ⇒ Object
Returns the Tracker generated from the scan.
Constructor Details
#initialize(options, processor = nil) ⇒ Scanner
Pass in path to the root of the Rails application
23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
# File 'lib/brakeman/scanner.rb', line 23 def initialize , processor = nil @options = @app_tree = Brakeman::AppTree.() if !@app_tree.root || !@app_tree.exists?("app") raise Brakeman::NoApplication, "Please supply the path to a Rails application." end if @app_tree.exists?("script/rails") [:rails3] = true Brakeman.notify "[Notice] Detected Rails 3 application" elsif not @app_tree.exists?("script") [:rails3] = true # Probably need to do some refactoring Brakeman.notify "[Notice] Detected Rails 4 application" end @ruby_parser = ::RubyParser @processor = processor || Brakeman::Processor.new(@app_tree, ) end |
Instance Attribute Details
#options ⇒ Object (readonly)
Returns the value of attribute options.
17 18 19 |
# File 'lib/brakeman/scanner.rb', line 17 def @options end |
Instance Method Details
#index_call_sites ⇒ Object
352 353 354 |
# File 'lib/brakeman/scanner.rb', line 352 def index_call_sites tracker.index_call_sites end |
#parse_ruby(input) ⇒ Object
356 357 358 |
# File 'lib/brakeman/scanner.rb', line 356 def parse_ruby input @ruby_parser.new.parse input end |
#process ⇒ Object
Process everything in the Rails application
49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 |
# File 'lib/brakeman/scanner.rb', line 49 def process Brakeman.notify "Processing gems..." process_gems Brakeman.notify "Processing configuration..." process_config Brakeman.notify "Processing initializers..." process_initializers Brakeman.notify "Processing libs..." process_libs Brakeman.notify "Processing routes... " process_routes Brakeman.notify "Processing templates... " process_templates Brakeman.notify "Processing models... " process_models Brakeman.notify "Processing controllers... " process_controllers Brakeman.notify "Indexing call sites... " index_call_sites tracker end |
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb
Stores parsed information in tracker.config
74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 |
# File 'lib/brakeman/scanner.rb', line 74 def process_config if [:rails3] process_config_file "application.rb" process_config_file "environments/production.rb" else process_config_file "environment.rb" process_config_file "gems.rb" end if @app_tree.exists?("vendor/plugins/rails_xss") or [:rails3] or [:escape_html] tracker.config[:escape_html] = true Brakeman.notify "[Notice] Escaping HTML by default" end end |
#process_controller(path) ⇒ Object
217 218 219 220 221 222 223 224 225 |
# File 'lib/brakeman/scanner.rb', line 217 def process_controller path begin @processor.process_controller(parse_ruby(@app_tree.read_path(path)), path) rescue Racc::ParseError => e tracker.error e, "could not parse #{path}. There is probably a typo in the file. Test it with 'ruby_parse #{path}'" rescue Exception => e tracker.error e.exception(e. + "\nWhile processing #{path}"), e.backtrace end end |
#process_controllers ⇒ Object
Process all .rb files in controllers/
Adds processed controllers to tracker.controllers
190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 |
# File 'lib/brakeman/scanner.rb', line 190 def process_controllers total = @app_tree.controller_paths.length current = 0 @app_tree.controller_paths.each do |f| Brakeman.debug "Processing #{f}" report_progress(current, total) current += 1 process_controller f end current = 0 total = tracker.controllers.length Brakeman.notify "Processing data flow in controllers..." tracker.controllers.sort_by{|name| name.to_s}.each do |name, controller| Brakeman.debug "Processing #{name}" report_progress(current, total, "controllers") current += 1 @processor.process_controller_alias name, controller[:src] end #No longer need these processed filter methods tracker.filter_cache.clear end |
#process_gems ⇒ Object
Process Gemfile
106 107 108 109 110 111 112 113 114 115 116 117 |
# File 'lib/brakeman/scanner.rb', line 106 def process_gems if @app_tree.exists? "Gemfile" if @app_tree.exists? "Gemfile.lock" @processor.process_gems(parse_ruby(@app_tree.read("Gemfile")), @app_tree.read("Gemfile.lock")) else @processor.process_gems(parse_ruby(@app_tree.read("Gemfile"))) end end rescue Exception => e Brakeman.notify "[Notice] Error while processing Gemfile." tracker.error e.exception(e. + "\nWhile processing Gemfile"), e.backtrace end |
#process_initializer(path) ⇒ Object
Process an initializer
129 130 131 132 133 134 135 136 137 |
# File 'lib/brakeman/scanner.rb', line 129 def process_initializer path begin @processor.process_initializer(path, parse_ruby(@app_tree.read_path(path))) rescue Racc::ParseError => e tracker.error e, "could not parse #{path}. There is probably a typo in the file. Test it with 'ruby_parse #{path}'" rescue Exception => e tracker.error e.exception(e. + "\nWhile processing #{path}"), e.backtrace end end |
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/
Adds parsed information to tracker.initializers
122 123 124 125 126 |
# File 'lib/brakeman/scanner.rb', line 122 def process_initializers @app_tree.initializer_paths.each do |f| process_initializer f end end |
#process_lib(path) ⇒ Object
Process a library
160 161 162 163 164 165 166 167 168 |
# File 'lib/brakeman/scanner.rb', line 160 def process_lib path begin @processor.process_lib parse_ruby(@app_tree.read_path(path)), path rescue Racc::ParseError => e tracker.error e, "could not parse #{path}. There is probably a typo in the file. Test it with 'ruby_parse #{path}'" rescue Exception => e tracker.error e.exception(e. + "\nWhile processing #{path}"), e.backtrace end end |
#process_libs ⇒ Object
Process all .rb in lib/
Adds parsed information to tracker.libs.
142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 |
# File 'lib/brakeman/scanner.rb', line 142 def process_libs if [:skip_libs] Brakeman.notify '[Skipping]' return end total = @app_tree.lib_paths.length current = 0 @app_tree.lib_paths.each do |f| Brakeman.debug "Processing #{f}" report_progress(current, total) current += 1 process_lib f end end |
#process_model(path) ⇒ Object
337 338 339 340 341 342 343 344 345 |
# File 'lib/brakeman/scanner.rb', line 337 def process_model path begin @processor.process_model(parse_ruby(@app_tree.read_path(path)), path) rescue Racc::ParseError => e tracker.error e, "could not parse #{path}" rescue Exception => e tracker.error e.exception(e. + "\nWhile processing #{path}"), e.backtrace end end |
#process_models ⇒ Object
Process all the .rb files in models/
Adds the processed models to tracker.models
325 326 327 328 329 330 331 332 333 334 335 |
# File 'lib/brakeman/scanner.rb', line 325 def process_models total = @app_tree.model_paths.length current = 0 @app_tree.model_paths.each do |f| Brakeman.debug "Processing #{f}" report_progress(current, total) current += 1 process_model f end end |
#process_routes ⇒ Object
Process config/routes.rb
Adds parsed information to tracker.routes
173 174 175 176 177 178 179 180 181 182 183 184 185 |
# File 'lib/brakeman/scanner.rb', line 173 def process_routes if @app_tree.exists?("config/routes.rb") begin @processor.process_routes parse_ruby(@app_tree.read("config/routes.rb")) rescue Exception => e tracker.error e.exception(e. + "\nWhile processing routes.rb"), e.backtrace Brakeman.notify "[Notice] Error while processing routes - assuming all public controller methods are actions." [:assume_all_routes] = true end else Brakeman.notify "[Notice] No route information found" end end |
#process_template(path) ⇒ Object
256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 |
# File 'lib/brakeman/scanner.rb', line 256 def process_template path type = path.match(KNOWN_TEMPLATE_EXTENSIONS)[1].to_sym type = :erb if type == :rhtml name = template_path_to_name path text = @app_tree.read_path path begin if type == :erb if tracker.config[:escape_html] type = :erubis if [:rails3] require 'brakeman/parsers/rails3_erubis' src = Brakeman::Rails3Erubis.new(text).src else require 'brakeman/parsers/rails2_xss_plugin_erubis' src = Brakeman::Rails2XSSPluginErubis.new(text).src end elsif tracker.config[:erubis] require 'brakeman/parsers/rails2_erubis' type = :erubis src = Brakeman::ScannerErubis.new(text).src else require 'erb' src = ERB.new(text, nil, "-").src src.sub!(/^#.*\n/, '') if RUBY_1_9 end parsed = parse_ruby src elsif type == :haml Brakeman.load_brakeman_dependency 'haml' Brakeman.load_brakeman_dependency 'sass' src = Haml::Engine.new(text, :escape_html => !!tracker.config[:escape_html]).precompiled parsed = parse_ruby src elsif type == :slim Brakeman.load_brakeman_dependency 'slim' src = Slim::Template.new(:disable_capture => true, :generator => Temple::Generators::RailsOutputBuffer) { text }.precompiled_template parsed = parse_ruby src else tracker.error "Unkown template type in #{path}" end @processor.process_template(name, parsed, type, nil, path) rescue Racc::ParseError => e tracker.error e, "could not parse #{path}" rescue Haml::Error => e tracker.error e, ["While compiling HAML in #{path}"] << e.backtrace rescue Exception => e tracker.error e.exception(e. + "\nWhile processing #{path}"), e.backtrace end end |
#process_templates ⇒ Object
Process all views and partials in views/
Adds processed views to tracker.views
230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 |
# File 'lib/brakeman/scanner.rb', line 230 def process_templates $stdout.sync = true count = 0 total = @app_tree.template_paths.length @app_tree.template_paths.each do |path| Brakeman.debug "Processing #{path}" report_progress(count, total) count += 1 process_template path end total = tracker.templates.length count = 0 Brakeman.notify "Processing data flow in templates..." tracker.templates.keys.dup.sort_by{|name| name.to_s}.each do |name| Brakeman.debug "Processing #{name}" report_progress(count, total, "templates") count += 1 @processor.process_template_alias tracker.templates[name] end end |
#report_progress(current, total, type = "files") ⇒ Object
347 348 349 350 |
# File 'lib/brakeman/scanner.rb', line 347 def report_progress(current, total, type = "files") return unless @options[:report_progress] $stderr.print " #{current}/#{total} #{type} processed\r" end |
#template_path_to_name(path) ⇒ Object
Convert path/filename to view name
views/test/something.html.erb -> test/something
316 317 318 319 320 |
# File 'lib/brakeman/scanner.rb', line 316 def template_path_to_name path names = path.split("/") names.last.gsub!(/(\.(html|js)\..*|\.rhtml)$/, '') names[(names.index("views") + 1)..-1].join("/").to_sym end |
#tracker ⇒ Object
Returns the Tracker generated from the scan
44 45 46 |
# File 'lib/brakeman/scanner.rb', line 44 def tracker @processor.tracked_events end |