Class: Brakeman::ControllerProcessor

Inherits:
BaseProcessor show all
Defined in:
lib/brakeman/processors/controller_processor.rb

Overview

Processes controller. Results are put in tracker.controllers

Constant Summary collapse

FORMAT_HTML = 
Sexp.new(:call, Sexp.new(:lvar, :format), :html)

Constants inherited from BaseProcessor

BaseProcessor::IGNORE

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseProcessor

#find_render_type, #ignore, #make_render, #make_render_in_view, #process_arglist, #process_attrasgn, #process_block, #process_default, #process_dstr, #process_evstr, #process_hash, #process_if, #process_ignore, #process_lasgn, #process_scope

Methods included from Util

#array?, #block?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#class_name, #process_all, #process_all!, #process_call_args, #process_module

Methods inherited from SexpProcessor

#error_handler, #in_context, #process, #process_dummy, #scope

Constructor Details

#initialize(app_tree, tracker) ⇒ ControllerProcessor

Returns a new instance of ControllerProcessor.



7
8
9
10
11
12
13
14
15
 
# File 'lib/brakeman/processors/controller_processor.rb', line 7

def initialize app_tree, tracker
  super(tracker)
  @app_tree = app_tree
  @controller = nil
  @current_method = nil
  @current_module = nil
  @visibility = :public
  @file_name = nil
end

Instance Method Details

#add_fake_filter(exp) ⇒ Object

This is to handle before_filter do |controller| … end

We build a new method and process that the same way as usual methods and filters.



222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
 
# File 'lib/brakeman/processors/controller_processor.rb', line 222

def add_fake_filter exp
  unless @controller
    Brakeman.debug "Skipping before_filter outside controller: #{exp}"
    return exp
  end

  filter_name = ("fake_filter" + rand.to_s[/\d+$/]).to_sym
  args = exp.block_call.arglist
  args.insert(1, Sexp.new(:lit, filter_name))
  before_filter_call = make_call(nil, :before_filter, args)

  if exp.block_args.length > 1
    block_variable = exp.block_args[1]
  else
    block_variable = :temp
  end

  if node_type? exp.block, :block
    block_inner = exp.block[1..-1]
  else
    block_inner = [exp.block]
  end

  #Build Sexp for filter method
  body = Sexp.new(:lasgn,
                  block_variable, 
                  Sexp.new(:call, Sexp.new(:const, @controller[:name]), :new))

  filter_method = Sexp.new(:defn, filter_name, Sexp.new(:args), body).concat(block_inner).line(exp.line)

  vis = @visibility
  @visibility = :private
  process_defn filter_method
  @visibility = vis
  process before_filter_call
  exp
end

#process_call(exp) ⇒ Object

Look for specific calls inside the controller



93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
 
# File 'lib/brakeman/processors/controller_processor.rb', line 93

def process_call exp
  target = exp.target
  if sexp? target
    target = process target
  end

  method = exp.method
  first_arg = exp.first_arg
  last_arg = exp.last_arg

  #Methods called inside class definition
  #like attr_* and other settings
  if @current_method.nil? and target.nil? and @controller
    if first_arg.nil? #No args
      case method
      when :private, :protected, :public
        @visibility = method
      when :protect_from_forgery
        @controller[:options][:protect_from_forgery] = true
      else
        #??
      end
    else
      case method
      when :include
        @controller[:includes] << class_name(first_arg) if @controller
      when :before_filter, :append_before_filter
        @controller[:options][:before_filters] << exp.args
      when :prepend_before_filter
        @controller[:options][:before_filters].unshift exp.args
      when :layout
        if string? last_arg
          #layout "some_layout"

          name = last_arg.value.to_s
          if @app_tree.layout_exists?(name)
            @controller[:layout] = "layouts/#{name}"
          else
            Brakeman.debug "[Notice] Layout not found: #{name}"
          end
        elsif node_type? last_arg, :nil, :false
          #layout :false or layout nil
          @controller[:layout] = false
        end
      else
        @controller[:options][method] ||= []
        @controller[:options][method] << exp
      end
    end

    exp
  elsif target == nil and method == :render
    make_render exp
  elsif exp == FORMAT_HTML and context[1] != :iter
    #This is an empty call to
    # format.html
    #Which renders the default template if no arguments
    #Need to make more generic, though.
    call = Sexp.new :render, :default, @current_method
    call.line(exp.line)
    call
  else
    call = make_call target, method, process_all!(exp.args)
    call.line(exp.line)
    call
  end
end

#process_class(exp) ⇒ Object

s(:class, NAME, PARENT, s(:scope …))



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/brakeman/processors/controller_processor.rb', line 24

def process_class exp
  name = class_name(exp.class_name)
  parent = class_name(exp.parent_name)

  #If inside a real controller, treat any other classes as libraries.
  #But if not inside a controller already, then the class may include
  #a real controller, so we can't take this shortcut.
  if @controller and @controller[:name].to_s.end_with? "Controller"
    Brakeman.debug "[Notice] Treating inner class as library: #{name}"
    Brakeman::LibraryProcessor.new(@tracker).process_library exp, @file_name
    return exp
  end

  if not name.to_s.end_with? "Controller"
    Brakeman.debug "[Notice] Adding noncontroller as library: #{name}"

    current_controller = @controller

    #Set the class to be a module in order to get the right namespacing.
    #Add class to libraries, in case it is needed later (e.g. it's used
    #as a parent class for a controller.)
    #However, still want to process it in this class, so have to set
    #@controller to this not-really-a-controller thing.
    process_module exp do
      name = @current_module

      if @tracker.libs[name.to_sym]
        @controller = @tracker.libs[name]
      else
        set_controller name, parent, exp
        @tracker.libs[name.to_sym] = @controller
      end

      process_all exp.body
    end

    @controller = current_controller

    return exp
  end

  if @current_module
    name = (@current_module.to_s + "::" + name.to_s).to_sym
  end

  set_controller name, parent, exp

  @tracker.controllers[@controller[:name]] = @controller

  exp.body = process_all! exp.body
  set_layout_name

  @controller = nil
  exp
end

#process_controller(src, file_name = nil) ⇒ Object

Use this method to process a Controller



18
19
20
21
 
# File 'lib/brakeman/processors/controller_processor.rb', line 18

def process_controller src, file_name = nil
  @file_name = file_name
  process src
end

#process_defn(exp) ⇒ Object

Process method definition and store in Tracker



162
163
164
165
166
167
168
169
170
 
# File 'lib/brakeman/processors/controller_processor.rb', line 162

def process_defn exp
  name = exp.method_name
  @current_method = name
  res = Sexp.new :methdef, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil
  @controller[@visibility][name] = res unless @controller.nil?
  res
end

#process_defs(exp) ⇒ Object

Process self.method definition and store in Tracker



173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
 
# File 'lib/brakeman/processors/controller_processor.rb', line 173

def process_defs exp
  name = exp.method_name

  if exp[1].node_type == :self
    if @controller
      target = @controller[:name]
    elsif @current_module
      target = @current_module
    else
      target = nil
    end
  else
    target = class_name exp[1]
  end

  @current_method = name
  res = Sexp.new :selfdef, target, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil
  @controller[@visibility][name] = res unless @controller.nil?

  res
end

#process_iter(exp) ⇒ Object

Look for before_filters and add fake ones if necessary



198
199
200
201
202
203
204
 
# File 'lib/brakeman/processors/controller_processor.rb', line 198

def process_iter exp
  if exp.block_call.method == :before_filter
    add_fake_filter exp
  else
    super
  end
end

#set_controller(name, parent, exp) ⇒ Object 



80
81
82
83
84
85
86
87
88
89
90
 
# File 'lib/brakeman/processors/controller_processor.rb', line 80

def set_controller name, parent, exp
  @controller = { :name => name,
                  :parent => parent,
                  :includes => [],
                  :public => {},
                  :private => {},
                  :protected => {},
                  :options => {:before_filters => []},
                  :src => exp,
                  :file => @file_name }
end

#set_layout_name ⇒ Object

Sets default layout for renders inside Controller



207
208
209
210
211
212
213
214
215
216
 
# File 'lib/brakeman/processors/controller_processor.rb', line 207

def set_layout_name
  return if @controller[:layout]

  name = underscore(@controller[:name].to_s.split("::")[-1].gsub("Controller", ''))

  #There is a layout for this Controller
  if @app_tree.layout_exists?(name)
    @controller[:layout] = "layouts/#{name}"
  end
end