Class: Brakeman::ControllerProcessor

Inherits:
BaseProcessor show all
Defined in:
lib/brakeman/processors/controller_processor.rb

Overview

Processes controller. Results are put in tracker.controllers

Constant Summary collapse

FORMAT_HTML = 
Sexp.new(:call, Sexp.new(:lvar, :format), :html)

Constants inherited from BaseProcessor

BaseProcessor::IGNORE

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseProcessor

#find_render_type, #ignore, #make_render, #make_render_in_view, #process_arglist, #process_attrasgn, #process_block, #process_default, #process_dstr, #process_evstr, #process_hash, #process_if, #process_ignore, #process_lasgn, #process_scope

Methods included from Util

#array?, #block?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#class_name, #process_all, #process_all!, #process_call_args

Methods inherited from SexpProcessor

#error_handler, #in_context, #process, #process_dummy, processors, #scope

Constructor Details

#initialize(app_tree, tracker) ⇒ ControllerProcessor

Returns a new instance of ControllerProcessor.



7
8
9
10
11
12
13
14
15
 
# File 'lib/brakeman/processors/controller_processor.rb', line 7

def initialize app_tree, tracker
  super(tracker)
  @app_tree = app_tree
  @current_class = nil
  @current_method = nil
  @current_module = nil
  @visibility = :public
  @file_name = nil
end

Instance Method Details

#add_fake_filter(exp) ⇒ Object

This is to handle before_filter do |controller| … end

We build a new method and process that the same way as usual methods and filters.



285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
 
# File 'lib/brakeman/processors/controller_processor.rb', line 285

def add_fake_filter exp
  unless @current_class
    Brakeman.debug "Skipping before_filter outside controller: #{exp}"
    return exp
  end

  filter_name = ("fake_filter" + rand.to_s[/\d+$/]).to_sym
  args = exp.block_call.arglist
  args.insert(1, Sexp.new(:lit, filter_name))
  before_filter_call = make_call(nil, :before_filter, args)

  if exp.block_args.length > 1
    block_variable = exp.block_args[1]
  else
    block_variable = :temp
  end

  if node_type? exp.block, :block
    block_inner = exp.block[1..-1]
  else
    block_inner = [exp.block]
  end

  #Build Sexp for filter method
  body = Sexp.new(:lasgn,
                  block_variable,
                  Sexp.new(:call, Sexp.new(:const, @current_class[:name]), :new))

  filter_method = Sexp.new(:defn, filter_name, Sexp.new(:args), body).concat(block_inner).line(exp.line)

  vis = @visibility
  @visibility = :private
  process_defn filter_method
  @visibility = vis
  process before_filter_call
  exp
end

#add_lambda_filter(exp) ⇒ Object 



323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
 
# File 'lib/brakeman/processors/controller_processor.rb', line 323

def add_lambda_filter exp
  # Convert into regular block call
  e = exp.dup
  lambda_node = e.delete_at(3)
  result = Sexp.new(:iter, e).line(e.line)

  # Add block arguments
  if node_type? lambda_node[2], :args
    result << lambda_node[2].last
  else
    result << s(:args)
  end

  # Add block contents
  if sexp? lambda_node[3]
    result << lambda_node[3]
  end

  add_fake_filter result
end

#process_call(exp) ⇒ Object

Look for specific calls inside the controller



134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
 
# File 'lib/brakeman/processors/controller_processor.rb', line 134

def process_call exp
  target = exp.target
  if sexp? target
    target = process target
  end

  method = exp.method
  first_arg = exp.first_arg
  last_arg = exp.last_arg

  #Methods called inside class definition
  #like attr_* and other settings
  if @current_method.nil? and target.nil? and @current_class
    if first_arg.nil? #No args
      case method
      when :private, :protected, :public
        @visibility = method
      when :protect_from_forgery
        @current_class[:options][:protect_from_forgery] = true
      else
        #??
      end
    else
      case method
      when :include
        @current_class[:includes] << class_name(first_arg) if @current_class
      when :before_filter, :append_before_filter, :before_action, :append_before_action
        if node_type? exp.first_arg, :iter
          add_lambda_filter exp
        else
          @current_class[:options][:before_filters] << exp
        end
      when :prepend_before_filter, :prepend_before_action
        if node_type? exp.first_arg, :iter
          add_lambda_filter exp
        else
          @current_class[:options][:before_filters].unshift exp
        end
      when :skip_before_filter, :skip_filter, :skip_before_action, :skip_action_callback
        @current_class[:options][:skip_filters] << exp
      when :layout
        if string? last_arg
          #layout "some_layout"

          name = last_arg.value.to_s
          if @app_tree.layout_exists?(name)
            @current_class[:layout] = "layouts/#{name}"
          else
            Brakeman.debug "[Notice] Layout not found: #{name}"
          end
        elsif node_type? last_arg, :nil, :false
          #layout :false or layout nil
          @current_class[:layout] = false
        end
      else
        @current_class[:options][method] ||= []
        @current_class[:options][method] << exp
      end
    end

    exp
  elsif target == nil and method == :render
    make_render exp
  elsif exp == FORMAT_HTML and context[1] != :iter
    #This is an empty call to
    # format.html
    #Which renders the default template if no arguments
    #Need to make more generic, though.
    call = Sexp.new :render, :default, @current_method
    call.line(exp.line)
    call
  else
    call = make_call target, method, process_all!(exp.args)
    call.line(exp.line)
    call
  end
end

#process_class(exp) ⇒ Object

s(:class, NAME, PARENT, s(:scope …))



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
 
# File 'lib/brakeman/processors/controller_processor.rb', line 24

def process_class exp
  name = class_name(exp.class_name)
  parent = class_name(exp.parent_name)

  #If inside a real controller, treat any other classes as libraries.
  #But if not inside a controller already, then the class may include
  #a real controller, so we can't take this shortcut.
  if @current_class and @current_class[:name].to_s.end_with? "Controller"
    Brakeman.debug "[Notice] Treating inner class as library: #{name}"
    Brakeman::LibraryProcessor.new(@tracker).process_library exp, @file_name
    return exp
  end

  if not name.to_s.end_with? "Controller"
    Brakeman.debug "[Notice] Adding noncontroller as library: #{name}"
    #Set the class to be a module in order to get the right namespacing.
    #Add class to libraries, in case it is needed later (e.g. it's used
    #as a parent class for a controller.)
    #However, still want to process it in this class, so have to set
    #@current_class to this not-really-a-controller thing.
    process_module exp, parent

    return exp
  end

  if @current_class
    outer_class = @current_class
    name = (outer_class[:name].to_s + "::" + name.to_s).to_sym
  end

  if @current_module
    name = (@current_module[:name].to_s + "::" + name.to_s).to_sym
  end

  if @tracker.controllers[name]
    @current_class = @tracker.controllers[name]
    @current_class[:files] << @file_name unless @current_class[:files].include? @file_name
    @current_class[:src][@file_name] = exp
  else
    @current_class = {
      :name => name,
      :parent => parent,
      :includes => [],
      :public => {},
      :private => {},
      :protected => {},
      :options => {:before_filters => [], :skip_filters => []},
      :src => { @file_name => exp },
      :files => [ @file_name ]
    }

    @tracker.controllers[name] = @current_class
  end

  exp.body = process_all! exp.body
  set_layout_name

  if outer_class
    @current_class = outer_class
  else
    @current_class = nil
  end

  exp
end

#process_controller(src, file_name = nil) ⇒ Object

Use this method to process a Controller



18
19
20
21
 
# File 'lib/brakeman/processors/controller_processor.rb', line 18

def process_controller src, file_name = nil
  @file_name = file_name
  process src
end

#process_defn(exp) ⇒ Object

Process method definition and store in Tracker



213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
 
# File 'lib/brakeman/processors/controller_processor.rb', line 213

def process_defn exp
  name = exp.method_name
  @current_method = name
  res = Sexp.new :methdef, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil

  if @current_class
    @current_class[@visibility][name] = { :src => res, :file => @file_name }
  elsif @current_module
    @current_module[@visibility][name] = { :src => res, :file => @file_name }
  end

  res
end

#process_defs(exp) ⇒ Object

Process self.method definition and store in Tracker



230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
 
# File 'lib/brakeman/processors/controller_processor.rb', line 230

def process_defs exp
  name = exp.method_name

  if exp[1].node_type == :self
    if @current_class
      target = @current_class[:name]
    elsif @current_module
      target = @current_module
    else
      target = nil
    end
  else
    target = class_name exp[1]
  end

  @current_method = name
  res = Sexp.new :selfdef, target, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil

  if @current_class
    @current_class[@visibility][name] = { :src => res, :file => @file_name }
  elsif @current_module
    @current_module[@visibility][name] = { :src => res, :file => @file_name }
  end

  res
end

#process_iter(exp) ⇒ Object

Look for before_filters and add fake ones if necessary



260
261
262
263
264
265
266
267
 
# File 'lib/brakeman/processors/controller_processor.rb', line 260

def process_iter exp
  block_call_name = exp.block_call.method
  if block_call_name == :before_filter  or block_call_name == :before_action
    add_fake_filter exp
  else
    super
  end
end

#process_module(exp, parent = nil) ⇒ Object 



90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/brakeman/processors/controller_processor.rb', line 90

def process_module exp, parent = nil
  name = class_name(exp.module_name)

  if @current_module
    outer_module = @current_module
    name = (outer_module[:name].to_s + "::" + name.to_s).to_sym
  end

  if @current_class
    name = (@current_class[:name].to_s + "::" + name.to_s).to_sym
  end

  if @tracker.libs[name]
    @current_module = @tracker.libs[name]
    @current_module[:files] << @file_name unless @current_module[:files].include? @file_name
    @current_module[:src][@file_name] = exp
  else
    @current_module = {
      :name => name,
      :parent => parent,
      :includes => [],
      :public => {},
      :private => {},
      :protected => {},
      :options => {:before_filters => []},
      :src => { @file_name => exp },
      :files => [ @file_name ]
    }

    @tracker.libs[name] = @current_module
  end

  exp.body = process_all! exp.body

  if outer_module
    @current_module = outer_module
  else
    @current_module = nil
  end

  exp
end

#set_layout_name ⇒ Object

Sets default layout for renders inside Controller



270
271
272
273
274
275
276
277
278
279
 
# File 'lib/brakeman/processors/controller_processor.rb', line 270

def set_layout_name
  return if @current_class[:layout]

  name = underscore(@current_class[:name].to_s.split("::")[-1].gsub("Controller", ''))

  #There is a layout for this Controller
  if @app_tree.layout_exists?(name)
    @current_class[:layout] = "layouts/#{name}"
  end
end