Class: Brakeman::ModelProcessor

Inherits:
BaseProcessor show all
Defined in:
lib/brakeman/processors/model_processor.rb

Overview

Processes models. Puts results in tracker.models

Constant Summary

Constants inherited from BaseProcessor

BaseProcessor::IGNORE

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseProcessor

#find_render_type, #ignore, #make_render, #make_render_in_view, #process_arglist, #process_attrasgn, #process_block, #process_default, #process_dstr, #process_evstr, #process_hash, #process_if, #process_ignore, #process_iter, #process_lasgn, #process_scope

Methods included from Util

#array?, #block?, #call?, #camelize, #class_name, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#process_all, #process_all!, #process_call_args, #process_call_defn?

Methods inherited from SexpProcessor

#in_context, #process, processors, #scope

Constructor Details

#initialize(tracker) ⇒ ModelProcessor

Returns a new instance of ModelProcessor.



7
8
9
10
11
12
13
14
 
# File 'lib/brakeman/processors/model_processor.rb', line 7

def initialize tracker
  super
  @current_class = nil
  @current_method = nil
  @current_module = nil
  @visibility = :public
  @file_name = nil
end

Instance Method Details

#process_call(exp) ⇒ Object

Handle calls outside of methods, such as include, attr_accessible, private, etc.



95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
 
# File 'lib/brakeman/processors/model_processor.rb', line 95

def process_call exp
  return exp unless @current_class
  return exp if process_call_defn? exp

  target = exp.target
  if sexp? target
    target = process target
  end

  method = exp.method
  first_arg = exp.first_arg

  #Methods called inside class definition
  #like attr_* and other settings
  if @current_method.nil? and target.nil?
    if first_arg.nil?
      case method
      when :private, :protected, :public
        @visibility = method
      when :attr_accessible
        @current_class.set_attr_accessible
      else
        #??
      end
    else
      case method
      when :include
        @current_class.add_include class_name(first_arg) if @current_class
      when :attr_accessible
        @current_class.set_attr_accessible exp
      when :attr_protected
        @current_class.set_attr_protected exp
      else
        if @current_class
          @current_class.add_option method, exp
        end
      end
    end

    exp
  else
    call = make_call target, method, process_all!(exp.args)
    call.line(exp.line)
    call
  end
end

#process_class(exp) ⇒ Object

s(:class, NAME, PARENT, BODY)



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/brakeman/processors/model_processor.rb', line 23

def process_class exp
  name = class_name(exp.class_name)
  parent = class_name(exp.parent_name)

  #If inside an inner class we treat it as a library.
  if @current_class
    Brakeman.debug "[Notice] Treating inner class as library: #{name}"
    Brakeman::LibraryProcessor.new(@tracker).process_library exp, @file_name
    return exp
  end

  if @current_class
    outer_class = @current_class
    name = (outer_class.name.to_s + "::" + name.to_s).to_sym
  end

  if @current_module
    name = (@current_module.name.to_s + "::" + name.to_s).to_sym
  end

  if @tracker.models[name]
    @current_class = @tracker.models[name]
    @current_class.add_file @file_name, exp
  else
    @current_class = Brakeman::Model.new name, parent, @file_name, exp, @tracker 
    @tracker.models[name] = @current_class
  end

  exp.body = process_all! exp.body

  if outer_class
    @current_class = outer_class
  else
    @current_class = nil
  end

  exp
end

#process_defn(exp) ⇒ Object

Add method definition to tracker



143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
 
# File 'lib/brakeman/processors/model_processor.rb', line 143

def process_defn exp
  return exp unless @current_class
  name = exp.method_name

  @current_method = name
  res = Sexp.new :defn, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil

  if @current_class
    @current_class.add_method @visibility, name, res, @file_name
  elsif @current_module
    @current_module.add_method @visibility, name, res, @file_name
  end

  res
end

#process_defs(exp) ⇒ Object

Add method definition to tracker



162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
 
# File 'lib/brakeman/processors/model_processor.rb', line 162

def process_defs exp
  return exp unless @current_class
  name = exp.method_name

  if node_type? exp[1], :self
    if @current_class
      target = @current_class.name
    elsif @current_module
      target = @current_module.name
    else
      target = nil
    end
  else
    target = class_name exp[1]
  end

  @current_method = name
  res = Sexp.new :defs, target, name, exp.formal_args, *process_all!(exp.body)
  res.line(exp.line)
  @current_method = nil

  if @current_class
    @current_class.add_method @visibility, name, res, @file_name
  elsif @current_module
    @current_module.add_method @visibility, name, res, @file_name
  end
  res
end

#process_model(src, file_name = nil) ⇒ Object

Process model source



17
18
19
20
 
# File 'lib/brakeman/processors/model_processor.rb', line 17

def process_model src, file_name = nil
  @file_name = file_name
  process src
end

#process_module(exp) ⇒ Object 



62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
 
# File 'lib/brakeman/processors/model_processor.rb', line 62

def process_module exp
  name = class_name(exp.class_name)

  if @current_module
    outer_module = @current_module
    name = (outer_module.name.to_s + "::" + name.to_s).to_sym
  end

  if @current_class
    name = (@current_class.name.to_s + "::" + name.to_s).to_sym
  end

  if @tracker.libs[name]
    @current_module = @tracker.libs[name]
    @current_module.add_file @file_name, exp
  else
    @current_module = Brakeman::Model.new name, nil, @file_name, exp, @tracker
    @tracker.libs[name] = @current_module
  end

  exp.body = process_all! exp.body

  if outer_module
    @current_module = outer_module
  else
    @current_module = nil
  end

  exp
end