Class: Brakeman::ModelProcessor

Inherits:
BaseProcessor show all
Defined in:
lib/brakeman/processors/model_processor.rb

Overview

Processes models. Puts results in tracker.models

Constant Summary collapse

ASSOCIATIONS = 
Set[:belongs_to, :has_one, :has_many, :has_and_belongs_to_many]

Constants inherited from BaseProcessor

BaseProcessor::IGNORE

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseProcessor

#find_render_type, #ignore, #make_render, #make_render_in_view, #process_arglist, #process_attrasgn, #process_block, #process_default, #process_dstr, #process_evstr, #process_hash, #process_if, #process_ignore, #process_iter, #process_lasgn, #process_scope

Methods included from Util

#array?, #block?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#class_name, #process_all, #process_all!, #process_call_args

Methods inherited from SexpProcessor

#error_handler, #in_context, #process, #process_dummy, #scope

Constructor Details

#initialize(tracker) ⇒ ModelProcessor

Returns a new instance of ModelProcessor.



8
9
10
11
12
13
14
15
 
# File 'lib/brakeman/processors/model_processor.rb', line 8

def initialize tracker
  super
  @current_class = nil
  @current_method = nil
  @current_module = nil
  @visibility = :public
  @file_name = nil
end

Instance Method Details

#process_call(exp) ⇒ Object

Handle calls outside of methods, such as include, attr_accessible, private, etc.



121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
 
# File 'lib/brakeman/processors/model_processor.rb', line 121

def process_call exp
  return exp unless @current_class
  target = exp.target
  if sexp? target
    target = process target
  end

  method = exp.method
  first_arg = exp.first_arg

  #Methods called inside class definition
  #like attr_* and other settings
  if @current_method.nil? and target.nil?
    if first_arg.nil?
      case method
      when :private, :protected, :public
        @visibility = method
      when :attr_accessible
        @current_class[:attr_accessible] ||= []
      else
        #??
      end
    else
      case method
      when :include
        @current_class[:includes] << class_name(first_arg) if @current_class
      when :attr_accessible
        @current_class[:attr_accessible] ||= []
        args = []

        exp.each_arg do |e|
          if node_type? e, :lit
            args << e.value
          elsif hash? e
            @current_class[:options][:role_accessible] ||= []
            @current_class[:options][:role_accessible].concat args
          end
        end

        @current_class[:attr_accessible].concat args
      else
        if @current_class
          if ASSOCIATIONS.include? method
            @current_class[:associations][method] ||= []
            @current_class[:associations][method].concat exp.args
          else
            @current_class[:options][method] ||= []
            @current_class[:options][method] << exp.arglist.line(exp.line)
          end
        end
      end
    end
    ignore
  else
    call = make_call target, method, process_all!(exp.args)
    call.line(exp.line)
    call
  end
end

#process_class(exp) ⇒ Object

s(:class, NAME, PARENT, BODY)



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/brakeman/processors/model_processor.rb', line 24

def process_class exp
  name = class_name(exp.class_name)
  parent = class_name(exp.parent_name)

  #If inside an inner class we treat it as a library.
  if @current_class
    Brakeman.debug "[Notice] Treating inner class as library: #{name}"
    Brakeman::LibraryProcessor.new(@tracker).process_library exp, @file_name
    return exp
  end

  if @current_class
    outer_class = @current_class
    name = (outer_class[:name].to_s + "::" + name.to_s).to_sym
  end

  if @current_module
    name = (@current_module[:name].to_s + "::" + name.to_s).to_sym
  end

  if @tracker.models[name]
    @current_class = @tracker.models[name]
    @current_class[:files] << @file_name unless @current_class[:files].include? @file_name
    @current_class[:src][@file_name] = exp
  else
    @current_class = {
      :name => name,
      :parent => parent,
      :includes => [],
      :public => {},
      :private => {},
      :protected => {},
      :options => {},
      :src => { @file_name => exp },
      :associations => {},
      :files => [ @file_name ]
    }

    @tracker.models[name] = @current_class
  end

  exp.body = process_all! exp.body

  if outer_class
    @current_class = outer_class
  else
    @current_class = nil
  end

  exp
end

#process_defn(exp) ⇒ Object

Add method definition to tracker



182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
 
# File 'lib/brakeman/processors/model_processor.rb', line 182

def process_defn exp
  return exp unless @current_class
  name = exp.method_name

  @current_method = name
  res = Sexp.new :methdef, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil

  if @current_class
    @current_class[@visibility][name] = { :src => res, :file => @file_name }
  elsif @current_module
    @current_module[@visibility][name] = { :src => res, :file => @file_name }
  end

  res
end

#process_defs(exp) ⇒ Object

Add method definition to tracker



201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
 
# File 'lib/brakeman/processors/model_processor.rb', line 201

def process_defs exp
  return exp unless @current_class
  name = exp.method_name

  if exp[1].node_type == :self
    if @current_class
      target = @current_class[:name]
    elsif @current_module
      target = @current_module
    else
      target = nil
    end
  else
    target = class_name exp[1]
  end

  @current_method = name
  res = Sexp.new :selfdef, target, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil

  if @current_class
    @current_class[@visibility][name] = { :src => res, :file => @file_name }
  elsif @current_module
    @current_module[@visibility][name] = { :src => res, :file => @file_name }
  end
  res
end

#process_model(src, file_name = nil) ⇒ Object

Process model source



18
19
20
21
 
# File 'lib/brakeman/processors/model_processor.rb', line 18

def process_model src, file_name = nil
  @file_name = file_name
  process src
end

#process_module(exp) ⇒ Object 



76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/brakeman/processors/model_processor.rb', line 76

def process_module exp
  name = class_name(exp.class_name)

  if @current_module
    outer_module = @current_module
    name = (outer_module[:name].to_s + "::" + name.to_s).to_sym
  end

  if @current_class
    name = (@current_class[:name].to_s + "::" + name.to_s).to_sym
  end

  if @tracker.libs[name]
    @current_module = @tracker.libs[name]
    @current_module[:files] << @file_name unless @current_module[:files].include? @file_name
    @current_module[:src][@file_name] = exp
  else
    @current_module = {
      :name => name,
      :includes => [],
      :public => {},
      :private => {},
      :protected => {},
      :options => {},
      :src => { @file_name => exp },
      :associations => {},
      :files => [ @file_name ]
    }

    @tracker.libs[name] = @current_module
  end

  exp.body = process_all! exp.body

  if outer_module
    @current_module = outer_module
  else
    @current_module = nil
  end

  exp
end