Class: Brakeman::TemplateAliasProcessor
- Inherits:
-
AliasProcessor
- Object
- SexpProcessor
- AliasProcessor
- Brakeman::TemplateAliasProcessor
- Includes:
- RenderHelper
- Defined in:
- lib/brakeman/processors/template_alias_processor.rb
Overview
Processes aliasing in templates. Handles calls to render
.
Constant Summary collapse
- FORM_METHODS =
Set[:form_for, :remote_form_for, :form_remote_for]
- UNKNOWN_MODEL_CALL =
Sexp.new(:call, Sexp.new(:const, Brakeman::Tracker::UNKNOWN_MODEL), :new)
- FORM_BUILDER_CALL =
Sexp.new(:call, Sexp.new(:const, :FormBuilder), :new)
Constants included from Util
Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP
Constants inherited from SexpProcessor
Instance Attribute Summary
Attributes inherited from AliasProcessor
Attributes inherited from SexpProcessor
Instance Method Summary collapse
-
#find_push_target(exp) ⇒ Object
Ignore ‘<<` calls on template variables which are used by the templating library (HAML, ERB, etc.).
-
#get_model_target(exp) ⇒ Object
Checks if
exp
is a call to Model.all or Model.find*. -
#initialize(tracker, template, called_from = nil) ⇒ TemplateAliasProcessor
constructor
A new instance of TemplateAliasProcessor.
-
#process_call_with_block(exp) ⇒ Object
(also: #process_iter)
Looks for form methods and iterating over collections of Models.
-
#process_template(name, args) ⇒ Object
Process template.
-
#template_name(name) ⇒ Object
Determine template name.
Methods included from RenderHelper
#get_class_target, #get_options, #process_action, #process_layout, #process_partial, #process_render
Methods inherited from AliasProcessor
#assign_args, #collapse_send_call, #duplicate?, #find_method, #get_call_value, #join_arrays, #join_strings, #merge_if_branch, #meth_env, #only_ivars, #only_request_vars, #process_array_access, #process_attrasgn, #process_block, #process_call, #process_cdecl, #process_cvdecl, #process_default, #process_gasgn, #process_hash_access, #process_hash_merge, #process_hash_merge!, #process_helper_method, #process_iasgn, #process_if, #process_if_branch, #process_lasgn, #process_masgn, #process_methdef, #process_op_asgn1, #process_op_asgn2, #process_or_simple_operation, #process_or_target, #process_safely, #process_scope, #process_selfdef, #process_svalue, #same_value?, #self_assign?, #self_assign_target?, #self_assign_var?, #set_value, #too_deep?, #top_target, #value_from_if
Methods included from Util
#array?, #block?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore
Methods included from ProcessorHelper
#class_name, #process_all, #process_all!, #process_call_args, #process_class, #process_module
Methods inherited from SexpProcessor
#error_handler, #in_context, #process, #process_dummy, #scope
Constructor Details
#initialize(tracker, template, called_from = nil) ⇒ TemplateAliasProcessor
Returns a new instance of TemplateAliasProcessor.
13 14 15 16 17 |
# File 'lib/brakeman/processors/template_alias_processor.rb', line 13 def initialize tracker, template, called_from = nil super tracker @template = template @called_from = called_from end |
Instance Method Details
#find_push_target(exp) ⇒ Object
Ignore ‘<<` calls on template variables which are used by the templating library (HAML, ERB, etc.)
100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 |
# File 'lib/brakeman/processors/template_alias_processor.rb', line 100 def find_push_target exp if sexp? exp if exp.node_type == :lvar and (exp.value == :_buf or exp.value == :_erbout) return nil elsif exp.node_type == :ivar and exp.value == :@output_buffer return nil elsif exp.node_type == :call and call? exp.target and exp.target.method == :_hamlout and exp.method == :buffer return nil end end super end |
#get_model_target(exp) ⇒ Object
Checks if exp
is a call to Model.all or Model.find*
82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 |
# File 'lib/brakeman/processors/template_alias_processor.rb', line 82 def get_model_target exp if call? exp target = exp.target if exp.method == :all or exp.method.to_s[0,4] == "find" models = Set.new @tracker.models.keys name = class_name target return target if models.include?(name) end return get_model_target(target) end false end |
#process_call_with_block(exp) ⇒ Object Also known as: process_iter
Looks for form methods and iterating over collections of Models
45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 |
# File 'lib/brakeman/processors/template_alias_processor.rb', line 45 def process_call_with_block exp process_default exp call = exp.block_call if call? call target = call.target method = call.method arg = exp.block_args.first_param block = exp.block #Check for e.g. Model.find.each do ... end if method == :each and arg and block and model = get_model_target(target) if arg.is_a? Symbol if model == target.target env[Sexp.new(:lvar, arg)] = Sexp.new(:call, model, :new) else env[Sexp.new(:lvar, arg)] = UNKNOWN_MODEL_CALL end process block if sexp? block end elsif FORM_METHODS.include? method if arg.is_a? Symbol env[Sexp.new(:lvar, arg)] = FORM_BUILDER_CALL process block if sexp? block end end end exp end |
#process_template(name, args) ⇒ Object
Process template
20 21 22 23 24 25 26 27 28 29 30 31 |
# File 'lib/brakeman/processors/template_alias_processor.rb', line 20 def process_template name, args if @called_from unless @called_from.grep(/Template:#{name}$/).empty? Brakeman.debug "Skipping circular render from #{@template[:name]} to #{name}" return end super name, args, @called_from + ["Template:#{@template[:name]}"] else super name, args, ["Template:#{@template[:name]}"] end end |
#template_name(name) ⇒ Object
Determine template name
34 35 36 37 38 39 |
# File 'lib/brakeman/processors/template_alias_processor.rb', line 34 def template_name name if !name.to_s.include?('/') && @template[:name].to_s.include?('/') name = "#{@template[:name].to_s.match(/^(.*\/).*$/)[1]}#{name}" end name end |