Class: Brakeman::SlimTemplateProcessor

Inherits:
TemplateProcessor show all
Includes:
RenderHelper
Defined in:
lib/brakeman/processors/slim_template_processor.rb

Constant Summary collapse

SAFE_BUFFER = 
s(:call, s(:colon2, s(:const, :ActiveSupport), :SafeBuffer), :new)
OUTPUT_BUFFER = 
s(:ivar, :@output_buffer)
TEMPLE_UTILS = 
s(:colon2, s(:colon3, :Temple), :Utils)

Constants inherited from BaseProcessor

BaseProcessor::IGNORE

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP

Constants inherited from SexpProcessor

Brakeman::SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods included from RenderHelper

#get_class_target, #get_options, #process_action, #process_layout, #process_partial, #process_template, #template_name

Methods inherited from TemplateProcessor

#add_escaped_output, #add_output, #initialize, #normalize_output, #process, #process_escaped_output, #process_lasgn, #process_output

Methods inherited from BaseProcessor

#find_render_type, #ignore, #initialize, #make_inline_render, #make_render, #make_render_in_view, #process_arglist, #process_attrasgn, #process_block, #process_cdecl, #process_default, #process_dstr, #process_evstr, #process_file, #process_hash, #process_if, #process_ignore, #process_iter, #process_lasgn, #process_scope

Methods included from Util

#array?, #block?, #call?, #camelize, #class_name, #constant?, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module

Methods inherited from SexpProcessor

#in_context, #initialize, #process, processors, #scope

Constructor Details

This class inherits a constructor from Brakeman::TemplateProcessor

Instance Method Details

#is_escaped?(exp) ⇒ Boolean

Returns:

  • (Boolean) 


76
77
78
79
80
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 76

def is_escaped? exp
  call? exp and
  exp.target == TEMPLE_UTILS and
  (exp.method == :escape_html or exp.method == :escape_html_safe)
end

#process_call(exp) ⇒ Object 



11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 11

def process_call exp
  target = exp.target
  method = exp.method

  if method == :safe_concat and (target == SAFE_BUFFER or target == OUTPUT_BUFFER)
    arg = normalize_output(exp.first_arg)

    if is_escaped? arg
      add_escaped_output arg
    elsif string? arg
      ignore
    elsif render? arg
      add_output make_render_in_view arg
    elsif string_interp? arg
      process_inside_interp arg
    elsif node_type? arg, :ignore
      ignore
    else
      add_output arg
    end
  elsif is_escaped? exp
    add_escaped_output exp.first_arg
  elsif target == nil and method == :render
    exp.arglist = process exp.arglist
    make_render_in_view exp
  else
    exp.arglist = process exp.arglist
    exp
  end
end

#process_inside_interp(exp) ⇒ Object

Slim likes to interpolate output into strings then pass them to safe_concat. Better to pull those values out directly.



44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 44

def process_inside_interp exp
  exp.map! do |e|
    if node_type? e, :evstr
      e.value = process_interp_output e.value
      e
    else
      e
    end
  end

  exp
end

#process_interp_output(exp) ⇒ Object 



57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 57

def process_interp_output exp
  if sexp? exp
    if node_type? exp, :if
      process_interp_output exp.then_clause
      process_interp_output exp.else_clause
    elsif exp == SAFE_BUFFER
      ignore
    elsif render? exp
      add_output make_render_in_view exp
    elsif node_type? :output, :escaped_output
      exp
    elsif is_escaped? exp
      add_escaped_output exp
    else
      add_output exp
    end
  end
end

#process_render(exp) ⇒ Object 



88
89
90
91
92
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 88

def process_render exp
  #Still confused as to why this is not needed in other template processors
  #but is needed here
  exp
end

#render?(exp) ⇒ Boolean

Returns:

  • (Boolean) 


82
83
84
85
86
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 82

def render? exp
  call? exp and
  exp.target.nil? and
  exp.method == :render
end