Class: Brakeman::AliasProcessor
- Inherits:
-
SexpProcessor
- Object
- SexpProcessor
- Brakeman::AliasProcessor
- Includes:
- ProcessorHelper, Util
- Defined in:
- lib/brakeman/processors/alias_processor.rb
Overview
Returns an s-expression with aliases replaced with their value. This does not preserve semantics (due to side effects, etc.), but it makes processing easier when searching for various things.
Direct Known Subclasses
ConfigAliasProcessor, ControllerAliasProcessor, RouteAliasProcessor, TemplateAliasProcessor
Constant Summary collapse
- ARRAY_CONST =
s(:const, :Array)
- HASH_CONST =
s(:const, :Hash)
Constants included from Util
Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP
Constants inherited from SexpProcessor
Instance Attribute Summary collapse
-
#result ⇒ Object
readonly
Returns the value of attribute result.
-
#tracker ⇒ Object
readonly
Returns the value of attribute tracker.
Attributes inherited from SexpProcessor
Instance Method Summary collapse
-
#array_include_all_literals?(exp) ⇒ Boolean
Check if exp is a call to Array#include? on an array literal that contains all literal values.
- #assign_args(method_exp, args, meth_env = SexpProcessor::Environment.new) ⇒ Object
-
#collapse_send_call(exp, first_arg) ⇒ Object
Change x.send(:y, 1) to x.y(1).
- #duplicate?(exp) ⇒ Boolean
- #find_method(*args) ⇒ Object
-
#find_push_target(exp) ⇒ Object
Finds the inner most call target which is not the target of a call to <<.
- #get_call_value(call) ⇒ Object
-
#get_rhs(exp) ⇒ Object
Handles x = y = z = 1.
-
#initialize(tracker = nil) ⇒ AliasProcessor
constructor
Returns a new AliasProcessor with an empty environment.
-
#join_arrays(array1, array2) ⇒ Object
Join two array literals into one.
-
#join_strings(string1, string2) ⇒ Object
Join two string literals into one.
- #merge_if_branch(branch_env) ⇒ Object
- #meth_env ⇒ Object
-
#only_ivars(include_request_vars = false, lenv = nil) ⇒ Object
Returns a new SexpProcessor::Environment containing only instance variables.
- #only_request_vars ⇒ Object
-
#process_array_access(target, args) ⇒ Object
Process single integer access to an array.
-
#process_attrasgn(exp) ⇒ Object
‘Attribute’ assignment x.y = 1 or x = 1.
-
#process_block(exp) ⇒ Object
Start new scope for block.
-
#process_call(exp) ⇒ Object
Process a method call.
-
#process_cdecl(exp) ⇒ Object
Constant assignments like BIG_CONSTANT = 234810983.
-
#process_cvdecl(exp) ⇒ Object
Class variable assignment @@x = 1.
-
#process_default(exp) ⇒ Object
Process a Sexp.
-
#process_defn(exp) ⇒ Object
Process a method definition.
-
#process_defs(exp) ⇒ Object
Process a method definition on self.
-
#process_gasgn(exp) ⇒ Object
Global assignment $x = 1.
-
#process_hash_access(target, index) ⇒ Object
Process hash access by returning the value associated with the given argument.
-
#process_hash_merge(hash, args) ⇒ Object
Return a new hash Sexp with the given values merged into it.
-
#process_hash_merge!(hash, args) ⇒ Object
Merge values into hash when processing.
- #process_helper_method(method_exp, args) ⇒ Object
-
#process_iasgn(exp) ⇒ Object
Instance variable assignment.
-
#process_if(exp) ⇒ Object
Sets @inside_if = true.
- #process_if_branch(exp) ⇒ Object
- #process_iter(exp) ⇒ Object
-
#process_lasgn(exp) ⇒ Object
Local assignment x = 1.
-
#process_masgn(exp) ⇒ Object
Multiple/parallel assignment:.
-
#process_op_asgn1(exp) ⇒ Object
Assignments like this x ||= 1.
-
#process_op_asgn2(exp) ⇒ Object
Assignments like this x.y ||= 1.
-
#process_or_simple_operation(exp) ⇒ Object
If possible, distribute operation over both sides of an or.
- #process_or_target(value, copy) ⇒ Object
-
#process_safely(src, set_env = nil) ⇒ Object
This method processes the given Sexp, but copies it first so the original argument will not be modified.
-
#process_scope(exp) ⇒ Object
Process a new scope.
-
#process_svalue(exp) ⇒ Object
This is the right hand side value of a multiple assignment, like ‘x = y, z`.
- #replace(exp, int = 0) ⇒ Object
-
#same_value?(lhs, rhs) ⇒ Boolean
Return true if lhs == rhs or lhs is an or expression and rhs is one of its values.
- #self_assign?(var, value) ⇒ Boolean
-
#self_assign_target?(var, value) ⇒ Boolean
Return true for x = x.blah.
-
#self_assign_var?(var, value) ⇒ Boolean
Return true if for x = blah or @x = blah.
-
#set_value(var, value) ⇒ Object
Set variable to given value.
- #too_deep?(exp) ⇒ Boolean
-
#top_target(exp, last = nil) ⇒ Object
Returns last non-nil target in a call chain.
- #value_from_if(exp) ⇒ Object
Methods included from Util
#array?, #block?, #call?, #camelize, #class_name, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore
Methods included from ProcessorHelper
#process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module
Methods inherited from SexpProcessor
#in_context, #process, processors, #scope
Constructor Details
#initialize(tracker = nil) ⇒ AliasProcessor
Returns a new AliasProcessor with an empty environment.
The recommended usage is:
AliasProcessor.new.process_safely src
19 20 21 22 23 24 25 26 27 28 29 30 31 |
# File 'lib/brakeman/processors/alias_processor.rb', line 19 def initialize tracker = nil super() @env = SexpProcessor::Environment.new @inside_if = false @ignore_ifs = nil @exp_context = [] @current_module = nil @tracker = tracker #set in subclass as necessary @helper_method_cache = {} @helper_method_info = Hash.new({}) @or_depth_limit = (tracker && tracker.[:branch_limit]) || 5 #arbitrary default set_env_defaults end |
Instance Attribute Details
#result ⇒ Object (readonly)
Returns the value of attribute result.
12 13 14 |
# File 'lib/brakeman/processors/alias_processor.rb', line 12 def result @result end |
#tracker ⇒ Object (readonly)
Returns the value of attribute tracker.
12 13 14 |
# File 'lib/brakeman/processors/alias_processor.rb', line 12 def tracker @tracker end |
Instance Method Details
#array_include_all_literals?(exp) ⇒ Boolean
Check if exp is a call to Array#include? on an array literal that contains all literal values. For example:
[1, 2, "a"].include? x
518 519 520 521 522 523 524 |
# File 'lib/brakeman/processors/alias_processor.rb', line 518 def array_include_all_literals? exp call? exp and exp.method == :include? and node_type? exp.target, :array and exp.target.length > 1 and exp.target.all? { |e| e.is_a? Symbol or node_type? e, :lit, :str } end |
#assign_args(method_exp, args, meth_env = SexpProcessor::Environment.new) ⇒ Object
800 801 802 803 804 805 806 807 808 809 810 811 812 |
# File 'lib/brakeman/processors/alias_processor.rb', line 800 def assign_args method_exp, args, meth_env = SexpProcessor::Environment.new formal_args = method_exp.formal_args formal_args.each_with_index do |arg, index| next if index == 0 if arg.is_a? Symbol and sexp? args[index - 1] meth_env[Sexp.new(:lvar, arg)] = args[index - 1] end end meth_env end |
#collapse_send_call(exp, first_arg) ⇒ Object
Change x.send(:y, 1) to x.y(1)
663 664 665 666 667 668 669 670 671 672 673 674 675 676 |
# File 'lib/brakeman/processors/alias_processor.rb', line 663 def collapse_send_call exp, first_arg # Handle try(&:id) if node_type? first_arg, :block_pass first_arg = first_arg[1] end return unless symbol? first_arg or string? first_arg exp.method = first_arg.value.to_sym args = exp.args exp.pop # remove last arg if args.length > 1 exp.arglist = args[1..-1] end end |
#duplicate?(exp) ⇒ Boolean
823 824 825 826 827 828 829 |
# File 'lib/brakeman/processors/alias_processor.rb', line 823 def duplicate? exp @exp_context[0..-2].reverse_each do |e| return true if exp == e end false end |
#find_method(*args) ⇒ Object
831 832 833 |
# File 'lib/brakeman/processors/alias_processor.rb', line 831 def find_method *args nil end |
#find_push_target(exp) ⇒ Object
Finds the inner most call target which is not the target of a call to <<
815 816 817 818 819 820 821 |
# File 'lib/brakeman/processors/alias_processor.rb', line 815 def find_push_target exp if call? exp and exp.method == :<< find_push_target exp.target else exp end end |
#get_call_value(call) ⇒ Object
715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 |
# File 'lib/brakeman/processors/alias_processor.rb', line 715 def get_call_value call method_name = call.method #Look for helper methods and see if we can get a return value if found_method = find_method(method_name, @current_class) helper = found_method[:method] if sexp? helper value = process_helper_method helper, call.args value.line(call.line) return value else raise "Unexpected value for method: #{found_method}" end else call end end |
#get_rhs(exp) ⇒ Object
Handles x = y = z = 1
293 294 295 296 297 298 299 |
# File 'lib/brakeman/processors/alias_processor.rb', line 293 def get_rhs exp if node_type? exp, :lasgn, :iasgn, :gasgn, :attrasgn, :cvdecl, :cdecl get_rhs(exp.rhs) else exp end end |
#join_arrays(array1, array2) ⇒ Object
Join two array literals into one.
644 645 646 647 648 |
# File 'lib/brakeman/processors/alias_processor.rb', line 644 def join_arrays array1, array2 result = Sexp.new(:array) result.concat array1[1..-1] result.concat array2[1..-1] end |
#join_strings(string1, string2) ⇒ Object
Join two string literals into one.
651 652 653 654 655 656 657 658 659 660 |
# File 'lib/brakeman/processors/alias_processor.rb', line 651 def join_strings string1, string2 result = Sexp.new(:str) result.value = string1.value + string2.value if result.value.length > 50 string1 else result end end |
#merge_if_branch(branch_env) ⇒ Object
595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 |
# File 'lib/brakeman/processors/alias_processor.rb', line 595 def merge_if_branch branch_env branch_env.each do |k, v| next if v.nil? current_val = env[k] if current_val unless same_value?(current_val, v) if too_deep? current_val # Give up branching, start over with latest value env[k] = v else env[k] = current_val.combine(v, k.line) end end else env[k] = v end end end |
#meth_env ⇒ Object
271 272 273 274 275 276 277 278 279 280 281 |
# File 'lib/brakeman/processors/alias_processor.rb', line 271 def meth_env begin env.scope do set_env_defaults @meth_env = env.current yield end ensure @meth_env = nil end end |
#only_ivars(include_request_vars = false, lenv = nil) ⇒ Object
Returns a new SexpProcessor::Environment containing only instance variables. This is useful, for example, when processing views.
680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 |
# File 'lib/brakeman/processors/alias_processor.rb', line 680 def only_ivars include_request_vars = false, lenv = nil lenv ||= env res = SexpProcessor::Environment.new if include_request_vars lenv.all.each do |k, v| #TODO Why would this have nil values? if (k.node_type == :ivar or request_value? k) and not v.nil? res[k] = v.dup end end else lenv.all.each do |k, v| #TODO Why would this have nil values? if k.node_type == :ivar and not v.nil? res[k] = v.dup end end end res end |
#only_request_vars ⇒ Object
703 704 705 706 707 708 709 710 711 712 713 |
# File 'lib/brakeman/processors/alias_processor.rb', line 703 def only_request_vars res = SexpProcessor::Environment.new env.all.each do |k, v| if request_value? k and not v.nil? res[k] = v.dup end end res end |
#process_array_access(target, args) ⇒ Object
Process single integer access to an array.
Returns the value inside the array, if possible.
626 627 628 629 630 631 632 633 634 635 |
# File 'lib/brakeman/processors/alias_processor.rb', line 626 def process_array_access target, args if args.length == 1 and integer? args.first index = args.first.value #Have to do this because first element is :array and we have to skip it target[1..-1][index] else nil end end |
#process_attrasgn(exp) ⇒ Object
‘Attribute’ assignment x.y = 1 or x = 1
369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 |
# File 'lib/brakeman/processors/alias_processor.rb', line 369 def process_attrasgn exp tar_variable = exp.target target = exp.target = process(exp.target) method = exp.method index_arg = exp.first_arg value_arg = exp.second_arg if method == :[]= index = exp.first_arg = process(index_arg) value = exp.second_arg = process(value_arg) match = Sexp.new(:call, target, :[], index) set_value match, value if hash? target env[tar_variable] = hash_insert target.deep_clone, index, value end elsif method.to_s[-1,1] == "=" exp.first_arg = process(index_arg) value = get_rhs(exp) #This is what we'll replace with the value match = Sexp.new(:call, target, method.to_s[0..-2].to_sym) set_value match, value else raise "Unrecognized assignment: #{exp}" end exp end |
#process_block(exp) ⇒ Object
Start new scope for block.
257 258 259 260 261 |
# File 'lib/brakeman/processors/alias_processor.rb', line 257 def process_block exp env.scope do process_default exp end end |
#process_call(exp) ⇒ Object
Process a method call.
86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 |
# File 'lib/brakeman/processors/alias_processor.rb', line 86 def process_call exp return exp if process_call_defn? exp target_var = exp.target target_var &&= target_var.deep_clone exp = process_default exp #In case it is replaced with something else unless call? exp return exp end target = exp.target method = exp.method first_arg = exp.first_arg if method == :send or method == :try collapse_send_call exp, first_arg end if node_type? target, :or and [:+, :-, :*, :/].include? method res = process_or_simple_operation(exp) return res if res elsif target == ARRAY_CONST and method == :new return Sexp.new(:array, *exp.args) elsif target == HASH_CONST and method == :new and first_arg.nil? and !node_type?(@exp_context.last, :iter) return Sexp.new(:hash) end #See if it is possible to simplify some basic cases #of addition/concatenation. case method when :+ if array? target and array? first_arg joined = join_arrays target, first_arg joined.line(exp.line) exp = joined elsif string? first_arg if string? target # "blah" + "blah" joined = join_strings target, first_arg joined.line(exp.line) exp = joined elsif call? target and target.method == :+ and string? target.first_arg joined = join_strings target.first_arg, first_arg joined.line(exp.line) target.first_arg = joined exp = target end elsif number? first_arg if number? target exp = Sexp.new(:lit, target.value + first_arg.value) elsif call? target and target.method == :+ and number? target.first_arg target.first_arg = Sexp.new(:lit, target.first_arg.value + first_arg.value) exp = target end end when :- if number? target and number? first_arg exp = Sexp.new(:lit, target.value - first_arg.value) end when :* if number? target and number? first_arg exp = Sexp.new(:lit, target.value * first_arg.value) end when :/ if number? target and number? first_arg if first_arg.value == 0 and not target.value.is_a? Float if @tracker location = [@current_class, @current_method, "line #{first_arg.line}"].compact.join(' ') require 'brakeman/processors/output_processor' code = Brakeman::OutputProcessor.new.format(exp) @tracker.error Exception.new("Potential divide by zero: #{code} (#{location})") end else exp = Sexp.new(:lit, target.value / first_arg.value) end end when :[] if array? target temp_exp = process_array_access target, exp.args exp = temp_exp if temp_exp elsif hash? target temp_exp = process_hash_access target, first_arg exp = temp_exp if temp_exp end when :merge!, :update if hash? target and hash? first_arg target = process_hash_merge! target, first_arg env[target_var] = target return target end when :merge if hash? target and hash? first_arg return process_hash_merge(target, first_arg) end when :<< if string? target and string? first_arg target.value << first_arg.value env[target_var] = target return target elsif string? target and string_interp? first_arg exp = Sexp.new(:dstr, target.value + first_arg[1]).concat(first_arg[2..-1]) env[target_var] = exp elsif string? first_arg and string_interp? target if string? target.last target.last.value << first_arg.value elsif target.last.is_a? String target.last << first_arg.value else target << first_arg end env[target_var] = target return first_arg elsif array? target target << first_arg env[target_var] = target return target else target = find_push_target(target_var) env[target] = exp unless target.nil? # Happens in TemplateAliasProcessor end end exp end |
#process_cdecl(exp) ⇒ Object
Constant assignments like BIG_CONSTANT = 234810983
497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 |
# File 'lib/brakeman/processors/alias_processor.rb', line 497 def process_cdecl exp if sexp? exp.rhs exp.rhs = process exp.rhs end if exp.lhs.is_a? Symbol match = Sexp.new(:const, exp.lhs) else match = exp.lhs end env[match] = get_rhs(exp) exp end |
#process_cvdecl(exp) ⇒ Object
Class variable assignment @@x = 1
355 356 357 358 359 360 361 362 363 |
# File 'lib/brakeman/processors/alias_processor.rb', line 355 def process_cvdecl exp match = Sexp.new(:cvar, exp.lhs) exp.rhs = process(exp.rhs) value = get_rhs(exp) set_value match, value exp end |
#process_default(exp) ⇒ Object
Process a Sexp. If the Sexp has a value associated with it in the environment, that value will be returned.
50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 |
# File 'lib/brakeman/processors/alias_processor.rb', line 50 def process_default exp @exp_context.push exp begin exp.map! do |e| if sexp? e and not e.empty? process e else e end end rescue => err @tracker.error err if @tracker end result = replace(exp) @exp_context.pop result end |
#process_defn(exp) ⇒ Object
Process a method definition.
264 265 266 267 268 269 |
# File 'lib/brakeman/processors/alias_processor.rb', line 264 def process_defn exp meth_env do exp.body = process_all! exp.body end exp end |
#process_defs(exp) ⇒ Object
Process a method definition on self.
284 285 286 287 288 289 290 |
# File 'lib/brakeman/processors/alias_processor.rb', line 284 def process_defs exp env.scope do set_env_defaults exp.body = process_all! exp.body end exp end |
#process_gasgn(exp) ⇒ Object
Global assignment $x = 1
342 343 344 345 346 347 348 349 350 351 |
# File 'lib/brakeman/processors/alias_processor.rb', line 342 def process_gasgn exp match = Sexp.new(:gvar, exp.lhs) exp.rhs = process(exp.rhs) value = get_rhs(exp) value.line = exp.line set_value match, value exp end |
#process_hash_access(target, index) ⇒ Object
Process hash access by returning the value associated with the given argument.
639 640 641 |
# File 'lib/brakeman/processors/alias_processor.rb', line 639 def process_hash_access target, index hash_access(target, index) end |
#process_hash_merge(hash, args) ⇒ Object
Return a new hash Sexp with the given values merged into it.
args
should be a hash Sexp as well.
442 443 444 445 446 447 448 |
# File 'lib/brakeman/processors/alias_processor.rb', line 442 def process_hash_merge hash, args hash = hash.deep_clone hash_iterate args do |key, replacement| hash_insert hash, key, replacement end hash end |
#process_hash_merge!(hash, args) ⇒ Object
Merge values into hash when processing
h.merge! :something => “value”
429 430 431 432 433 434 435 436 437 |
# File 'lib/brakeman/processors/alias_processor.rb', line 429 def process_hash_merge! hash, args hash = hash.deep_clone hash_iterate args do |key, replacement| hash_insert hash, key, replacement match = Sexp.new(:call, hash, :[], key) env[match] = replacement end hash end |
#process_helper_method(method_exp, args) ⇒ Object
734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 |
# File 'lib/brakeman/processors/alias_processor.rb', line 734 def process_helper_method method_exp, args method_name = method_exp.method_name Brakeman.debug "Processing method #{method_name}" info = @helper_method_info[method_name] #If method uses instance variables, then include those and request #variables (params, etc) in the method environment. Otherwise, #only include request variables. if info[:uses_ivars] meth_env = only_ivars(:include_request_vars) else meth_env = only_request_vars end #Add arguments to method environment assign_args method_exp, args, meth_env #Find return values if method does not depend on environment/args values = @helper_method_cache[method_name] unless values #Serialize environment for cache key meth_values = meth_env.instance_variable_get(:@env).to_a meth_values.sort! meth_values = meth_values.to_s digest = Digest::SHA1.new.update(meth_values << method_name.to_s).to_s.to_sym values = @helper_method_cache[digest] end if values #Use values from cache values[:ivar_values].each do |var, val| env[var] = val end values[:return_value] else #Find return value for method frv = Brakeman::FindReturnValue.new value = frv.get_return_value(method_exp.body_list, meth_env) ivars = {} only_ivars(false, meth_env).all.each do |var, val| env[var] = val ivars[var] = val end if not frv.uses_ivars? and args.length == 0 #Store return value without ivars and args if they are not used @helper_method_cache[method_exp.method_name] = { :return_value => value, :ivar_values => ivars } else @helper_method_cache[digest] = { :return_value => value, :ivar_values => ivars } end #Store information about method, just ivar usage for now @helper_method_info[method_name] = { :uses_ivars => frv.uses_ivars? } value end end |
#process_iasgn(exp) ⇒ Object
Instance variable assignment
322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 |
# File 'lib/brakeman/processors/alias_processor.rb', line 322 def process_iasgn exp self_assign = self_assign?(exp.lhs, exp.rhs) exp.rhs = process exp.rhs ivar = Sexp.new(:ivar, exp.lhs).line(exp.line) if self_assign if env[ivar].nil? and @meth_env @meth_env[ivar] = get_rhs(exp) else env[ivar] = get_rhs(exp) end else set_value ivar, get_rhs(exp) end exp end |
#process_if(exp) ⇒ Object
Sets @inside_if = true
527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 |
# File 'lib/brakeman/processors/alias_processor.rb', line 527 def process_if exp if @ignore_ifs.nil? @ignore_ifs = @tracker && @tracker.[:ignore_ifs] end condition = process exp.condition #Check if a branch is obviously going to be taken if true? condition no_branch = true exps = [exp.then_clause, nil] elsif false? condition no_branch = true exps = [nil, exp.else_clause] else no_branch = false exps = [exp.then_clause, exp.else_clause] end if @ignore_ifs or no_branch exps.each_with_index do |branch, i| exp[2 + i] = process_if_branch branch end else was_inside = @inside_if @inside_if = true branch_scopes = [] exps.each_with_index do |branch, i| scope do @branch_env = env.current branch_index = 2 + i # s(:if, condition, then_branch, else_branch) if i == 0 and array_include_all_literals? condition # If the condition is ["a", "b"].include? x # set x to "a" inside the true branch var = condition.first_arg previous_value = env.current[var] env.current[var] = condition.target[1] exp[branch_index] = process_if_branch branch env.current[var] = previous_value else exp[branch_index] = process_if_branch branch end branch_scopes << env.current @branch_env = nil end end @inside_if = was_inside branch_scopes.each do |s| merge_if_branch s end end exp end |
#process_if_branch(exp) ⇒ Object
585 586 587 588 589 590 591 592 593 |
# File 'lib/brakeman/processors/alias_processor.rb', line 585 def process_if_branch exp if sexp? exp if block? exp process_default exp else process exp end end end |
#process_iter(exp) ⇒ Object
211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 |
# File 'lib/brakeman/processors/alias_processor.rb', line 211 def process_iter exp @exp_context.push exp exp[1] = process exp.block_call @exp_context.pop env.scope do exp.block_args.each do |e| #Force block arg(s) to be local if node_type? e, :lasgn env.current[Sexp.new(:lvar, e.lhs)] = Sexp.new(:lvar, e.lhs) elsif node_type? e, :kwarg env.current[Sexp.new(:lvar, e[1])] = e[2] elsif node_type? e, :masgn, :shadow e[1..-1].each do |var| local = Sexp.new(:lvar, var) env.current[local] = local end elsif e.is_a? Symbol local = Sexp.new(:lvar, e) env.current[local] = local else raise "Unexpected value in block args: #{e.inspect}" end end block = exp.block if block? block process_all! block else exp[3] = process block end end exp end |
#process_lasgn(exp) ⇒ Object
Local assignment x = 1
303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 |
# File 'lib/brakeman/processors/alias_processor.rb', line 303 def process_lasgn exp self_assign = self_assign?(exp.lhs, exp.rhs) exp.rhs = process exp.rhs if sexp? exp.rhs return exp if exp.rhs.nil? local = Sexp.new(:lvar, exp.lhs).line(exp.line || -2) if self_assign # Skip branching env[local] = get_rhs(exp) else set_value local, get_rhs(exp) end exp end |
#process_masgn(exp) ⇒ Object
Multiple/parallel assignment:
x, y = z, w
402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 |
# File 'lib/brakeman/processors/alias_processor.rb', line 402 def process_masgn exp unless array? exp[1] and array? exp[2] and exp[1].length == exp[2].length return process_default(exp) end vars = exp[1].dup vals = exp[2].dup vars.shift vals.shift # Call each assignment as if it is normal vars.each_with_index do |var, i| val = vals[i] if val assign = var.dup assign.rhs = val process assign end end exp end |
#process_op_asgn1(exp) ⇒ Object
Assignments like this x ||= 1
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 |
# File 'lib/brakeman/processors/alias_processor.rb', line 452 def process_op_asgn1 exp return process_default(exp) if exp[3] != :"||" target = exp[1] = process(exp[1]) index = exp[2][1] = process(exp[2][1]) value = exp[4] = process(exp[4]) match = Sexp.new(:call, target, :[], index) unless env[match] if request_value? target env[match] = match.combine(value) else env[match] = value end end exp end |
#process_op_asgn2(exp) ⇒ Object
Assignments like this x.y ||= 1
473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 |
# File 'lib/brakeman/processors/alias_processor.rb', line 473 def process_op_asgn2 exp return process_default(exp) if exp[3] != :"||" target = exp[1] = process(exp[1]) value = exp[4] = process(exp[4]) method = exp[2] match = Sexp.new(:call, target, method.to_s[0..-2].to_sym) unless env[match] env[match] = value end exp end |
#process_or_simple_operation(exp) ⇒ Object
If possible, distribute operation over both sides of an or. For example,
(1 or 2) * 5
Becomes
(5 or 10)
Only works for strings and numbers right now.
939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 |
# File 'lib/brakeman/processors/alias_processor.rb', line 939 def process_or_simple_operation exp arg = exp.first_arg return nil unless string? arg or number? arg target = exp.target lhs = process_or_target(target.lhs, exp.dup) rhs = process_or_target(target.rhs, exp.dup) if lhs and rhs if same_value? lhs, rhs lhs else exp.target.lhs = lhs exp.target.rhs = rhs exp.target end else nil end end |
#process_or_target(value, copy) ⇒ Object
960 961 962 963 964 965 966 967 |
# File 'lib/brakeman/processors/alias_processor.rb', line 960 def process_or_target value, copy if string? value or number? value copy.target = value process copy else false end end |
#process_safely(src, set_env = nil) ⇒ Object
This method processes the given Sexp, but copies it first so the original argument will not be modified.
set_env should be an instance of SexpProcessor::Environment. If provided, it will be used as the starting environment.
This method returns a new Sexp with variables replaced with their values, where possible.
41 42 43 44 45 46 |
# File 'lib/brakeman/processors/alias_processor.rb', line 41 def process_safely src, set_env = nil @env = set_env || SexpProcessor::Environment.new @result = src.deep_clone process @result @result end |
#process_scope(exp) ⇒ Object
Process a new scope.
249 250 251 252 253 254 |
# File 'lib/brakeman/processors/alias_processor.rb', line 249 def process_scope exp env.scope do process exp.block end exp end |
#process_svalue(exp) ⇒ Object
This is the right hand side value of a multiple assignment, like ‘x = y, z`
491 492 493 |
# File 'lib/brakeman/processors/alias_processor.rb', line 491 def process_svalue exp exp.value end |
#replace(exp, int = 0) ⇒ Object
72 73 74 75 76 77 78 79 80 |
# File 'lib/brakeman/processors/alias_processor.rb', line 72 def replace exp, int = 0 return exp if int > 3 if replacement = env[exp] and not duplicate? replacement replace(replacement.deep_clone(exp.line), int + 1) else exp end end |
#same_value?(lhs, rhs) ⇒ Boolean
Return true if lhs == rhs or lhs is an or expression and rhs is one of its values
837 838 839 840 841 842 843 844 845 |
# File 'lib/brakeman/processors/alias_processor.rb', line 837 def same_value? lhs, rhs if lhs == rhs true elsif node_type? lhs, :or lhs.rhs == rhs or lhs.lhs == rhs else false end end |
#self_assign?(var, value) ⇒ Boolean
847 848 849 |
# File 'lib/brakeman/processors/alias_processor.rb', line 847 def self_assign? var, value self_assign_var?(var, value) or self_assign_target?(var, value) end |
#self_assign_target?(var, value) ⇒ Boolean
Return true for x = x.blah
860 861 862 863 864 865 866 867 868 |
# File 'lib/brakeman/processors/alias_processor.rb', line 860 def self_assign_target? var, value target = top_target(value) if node_type? target, :lvar, :ivar target = target.value end var == target end |
#self_assign_var?(var, value) ⇒ Boolean
Return true if for x = blah or @x = blah
852 853 854 855 856 857 |
# File 'lib/brakeman/processors/alias_processor.rb', line 852 def self_assign_var? var, value call? value and value.method == :+ and node_type? value.target, :lvar, :ivar and value.target.value == var end |
#set_value(var, value) ⇒ Object
Set variable to given value. Creates “branched” versions of values when appropriate. Avoids creating multiple branched versions inside same if branch.
907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 |
# File 'lib/brakeman/processors/alias_processor.rb', line 907 def set_value var, value if node_type? value, :if value = value_from_if(value) end if @ignore_ifs or not @inside_if if @meth_env and node_type? var, :ivar and env[var].nil? @meth_env[var] = value else env[var] = value end elsif env.current[var] env.current[var] = value elsif @branch_env and @branch_env[var] @branch_env[var] = value elsif @branch_env and @meth_env and node_type? var, :ivar @branch_env[var] = value else env.current[var] = value end end |
#too_deep?(exp) ⇒ Boolean
616 617 618 619 620 621 |
# File 'lib/brakeman/processors/alias_processor.rb', line 616 def too_deep? exp @or_depth_limit >= 0 and node_type? exp, :or and exp.or_depth and exp.or_depth >= @or_depth_limit end |
#top_target(exp, last = nil) ⇒ Object
Returns last non-nil target in a call chain
871 872 873 874 875 876 877 878 879 |
# File 'lib/brakeman/processors/alias_processor.rb', line 871 def top_target exp, last = nil if call? exp top_target exp.target, exp elsif node_type? exp, :iter top_target exp.block_call, last else exp || last end end |
#value_from_if(exp) ⇒ Object
881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 |
# File 'lib/brakeman/processors/alias_processor.rb', line 881 def value_from_if exp if block? exp.else_clause or block? exp.then_clause #If either clause is more than a single expression, just use entire #if expression for now exp elsif exp.else_clause.nil? exp.then_clause elsif exp.then_clause.nil? exp.else_clause else condition = exp.condition if true? condition exp.then_clause elsif false? condition exp.else_clause else exp.then_clause.combine(exp.else_clause, exp.line) end end end |