Class: Brakeman::Tracker

Inherits:
Object
  • Object
show all
Defined in:
lib/brakeman/tracker.rb

Overview

The Tracker keeps track of all the processed information.

Constant Summary collapse

UNKNOWN_MODEL =

Place holder when there should be a model, but it is not clear what model it will be.

:BrakemanUnresolvedModel

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(app_tree, processor = nil, options = {}) ⇒ Tracker

Creates a new Tracker.

The Processor argument is only used by other Processors that might need to access it.



25
26
27
28
29
30
31
32
33
 
# File 'lib/brakeman/tracker.rb', line 25

def initialize(app_tree, processor = nil, options = {})
  @app_tree = app_tree
  @processor = processor
  @options = options
  @file_cache = Brakeman::FileCache.new
  @pristine_file_cache = nil

  reset_all
end

Instance Attribute Details

#app_tree ⇒ Object

Returns the value of attribute app_tree.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def app_tree
  @app_tree
end

#checks ⇒ Object

Returns the value of attribute checks.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def checks
  @checks
end

#config ⇒ Object

Returns the value of attribute config.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def config
  @config
end

#constants ⇒ Object

Returns the value of attribute constants.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def constants
  @constants
end

#controllers ⇒ Object

Returns the value of attribute controllers.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def controllers
  @controllers
end

#duration ⇒ Object

Returns the value of attribute duration.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def duration
  @duration
end

#end_time ⇒ Object

Returns the value of attribute end_time.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def end_time
  @end_time
end

#errors ⇒ Object

Returns the value of attribute errors.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def errors
  @errors
end

#file_cache ⇒ Object

Returns the value of attribute file_cache.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def file_cache
  @file_cache
end

#filter_cache ⇒ Object

Returns the value of attribute filter_cache.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def filter_cache
  @filter_cache
end

#ignored_filter ⇒ Object

Returns the value of attribute ignored_filter.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def ignored_filter
  @ignored_filter
end

#initializers ⇒ Object

Returns the value of attribute initializers.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def initializers
  @initializers
end

#libs ⇒ Object

Returns the value of attribute libs.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def libs
  @libs
end

#models ⇒ Object

Returns the value of attribute models.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def models
  @models
end

#options ⇒ Object

Returns the value of attribute options.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def options
  @options
end

#pristine_file_cache ⇒ Object

Returns the value of attribute pristine_file_cache.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def pristine_file_cache
  @pristine_file_cache
end

#processor ⇒ Object

Returns the value of attribute processor.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def processor
  @processor
end

#routes ⇒ Object

Returns the value of attribute routes.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def routes
  @routes
end

#start_time ⇒ Object

Returns the value of attribute start_time.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def start_time
  @start_time
end

#template_cache ⇒ Object

Returns the value of attribute template_cache.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def template_cache
  @template_cache
end

#templates ⇒ Object

Returns the value of attribute templates.



12
13
14
 
# File 'lib/brakeman/tracker.rb', line 12

def templates
  @templates
end

Instance Method Details

#add_constant(name, value, context = nil) ⇒ Object 



204
205
206
 
# File 'lib/brakeman/tracker.rb', line 204

def add_constant name, value, context = nil
  @constants.add name, value, context unless @options[:disable_constant_tracking]
end

#add_errors(exceptions) ⇒ Object 



84
85
86
87
88
 
# File 'lib/brakeman/tracker.rb', line 84

def add_errors exceptions
  exceptions.each do |e|
    error(e)
  end
end

#app_path ⇒ Object 



100
101
102
 
# File 'lib/brakeman/tracker.rb', line 100

def app_path
  @app_path ||= File.expand_path @options[:app_path]
end

#check_initializers(target, method) ⇒ Object

Searches the initializers for a method call



170
171
172
173
174
175
176
177
178
 
# File 'lib/brakeman/tracker.rb', line 170

def check_initializers target, method
  finder = Brakeman::FindCall.new target, method, self

  initializers.sort.each do |name, initializer|
    finder.process_source initializer
  end

  finder.matches
end

#constant_lookup(name) ⇒ Object

This method does not return all constants at this time, just ones with “simple” values.



210
211
212
 
# File 'lib/brakeman/tracker.rb', line 210

def constant_lookup name
  @constants.get_simple_value name unless @options[:disable_constant_tracking]
end

#each_class ⇒ Object 



133
134
135
136
137
138
139
140
141
 
# File 'lib/brakeman/tracker.rb', line 133

def each_class
  [self.controllers, self.models, self.libs].each do |set|
    set.each do |set_name, collection|
      collection.src.each do |file, src|
        yield src, set_name, file
      end
    end
  end
end

#each_method ⇒ Object

Iterate over all methods



105
106
107
108
109
110
111
112
113
114
 
# File 'lib/brakeman/tracker.rb', line 105

def each_method
  [self.controllers, self.models, self.libs].each do |set|
    set.each do |set_name, collection|
      collection.each_method do |method_name, definition|
        src = definition.src
        yield src, set_name, method_name, definition.file
      end
    end
  end
end

#each_template ⇒ Object

Iterates over each template, yielding the name and the template. Prioritizes templates which have been rendered.



118
119
120
121
122
123
124
125
126
127
128
129
130
 
# File 'lib/brakeman/tracker.rb', line 118

def each_template
  if @processed.nil?
    @processed, @rest = templates.keys.sort_by{|template| template.to_s}.partition { |k| k.to_s.include? "." }
  end

  @processed.each do |k|
    yield k, templates[k]
  end

  @rest.each do |k|
    yield k, templates[k]
  end
end

#error(exception, backtrace = nil) ⇒ Object

Add an error to the list. If no backtrace is given, the one from the exception will be used.



68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/brakeman/tracker.rb', line 68

def error exception, backtrace = nil
  backtrace ||= exception.backtrace
  unless backtrace.is_a? Array
    backtrace = [ backtrace ]
  end

  Brakeman.debug exception
  Brakeman.debug backtrace

  @errors << {
    :exception => exception,
    :error => exception.to_s.gsub("\n", " "),
    :backtrace => backtrace
  }
end

#filtered_warnings ⇒ Object 



189
190
191
192
193
194
195
196
197
 
# File 'lib/brakeman/tracker.rb', line 189

def filtered_warnings
  if self.ignored_filter
    self.warnings.reject do |w|
      self.ignored_filter.ignored? w
    end
  else
    self.warnings
  end
end

#find_call(options) ⇒ Object

Find a method call.

Options:

* :target => target name(s)
* :method => method name(s)
* :chained => search in method chains

If :target => false or :target => nil, searches for methods without a target. Targets and methods can be specified as a symbol, an array of symbols, or a regular expression.

If :chained => true, matches target at head of method chain and method at end.

For example:

find_call :target => User, :method => :all, :chained => true

could match

User.human.active.all(...)



164
165
166
167
 
# File 'lib/brakeman/tracker.rb', line 164

def find_call options
  index_call_sites unless @call_index
  @call_index.find_calls options
end

#find_class(name) ⇒ Object 



214
215
216
217
218
219
220
221
222
 
# File 'lib/brakeman/tracker.rb', line 214

def find_class name
  [@controllers, @models, @libs].each do |collection|
    if c = collection[name]
      return c
    end
  end

  nil
end

#find_method(method_name, class_name, method_type = :instance) ⇒ Object 



224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
 
# File 'lib/brakeman/tracker.rb', line 224

def find_method method_name, class_name, method_type = :instance
  return nil unless method_name.is_a? Symbol

  klass = find_class(class_name)
  return nil unless klass

  cache_key = [klass, method_name, method_type]

  if method = @method_cache[cache_key]
    return method
  end

  if method = klass.get_method(method_name, method_type)
    return method
  else
    # Check modules included for method definition
    # TODO: only for instance methods, otherwise check extends!
    klass.includes.each do |included_name|
      if method = find_method(method_name, included_name, method_type)
        return (@method_cache[cache_key] = method)
      end
    end

    # Not in any included modules, check the parent
    @method_cache[cache_key] = find_method(method_name, klass.parent, method_type)
  end
end

#index_call_sites ⇒ Object 



252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
 
# File 'lib/brakeman/tracker.rb', line 252

def index_call_sites
  finder = Brakeman::FindAllCalls.new self

  self.each_method do |definition, set_name, method_name, file|
    finder.process_source definition, :class => set_name, :method => method_name, :file => file
  end

  self.each_class do |definition, set_name, file|
    finder.process_source definition, :class => set_name, :file => file
  end

  self.each_template do |_name, template|
    finder.process_source template.src, :template => template, :file => template.file
  end

  self.initializers.each do |file_name, src|
    finder.process_all_source src, :file => file_name
  end

  @call_index = Brakeman::CallIndex.new finder.calls
end

#marshallable ⇒ Object

Call this to be able to marshal the Tracker



438
439
440
441
 
# File 'lib/brakeman/tracker.rb', line 438

def marshallable
  @app_tree.marshallable
  self
end

#reindex_call_sites(locations) ⇒ Object

Reindex call sites

Takes a set of symbols which can include :templates, :models, or :controllers

This will limit reindexing to the given sets



280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
 
# File 'lib/brakeman/tracker.rb', line 280

def reindex_call_sites locations
  #If reindexing templates, models, controllers,
  #just redo everything.
  if locations.length == 3
    return index_call_sites
  end

  if locations.include? :templates
    @call_index.remove_template_indexes
  end

  classes_to_reindex = Set.new
  method_sets = []

  if locations.include? :models
    classes_to_reindex.merge self.models.keys
    method_sets << self.models
  end

  if locations.include? :controllers
    classes_to_reindex.merge self.controllers.keys
    method_sets << self.controllers
  end

  if locations.include? :libs
    classes_to_reindex.merge self.libs.keys
    method_sets << self.libs
  end

  if locations.include? :initializers
    self.initializers.each do |file_name, src|
      @call_index.remove_indexes_by_file file_name
    end
  end

  @call_index.remove_indexes_by_class classes_to_reindex

  finder = Brakeman::FindAllCalls.new self

  method_sets.each do |set|
    Brakeman.logger.spin

    set.each do |set_name, info|
      info.each_method do |method_name, definition|
        src = definition.src
        finder.process_source src, :class => set_name, :method => method_name, :file => definition.file
      end
    end
  end

  if locations.include? :templates
    self.each_template do |_name, template|
      Brakeman.logger.spin
      finder.process_source template.src, :template => template, :file => template.file
    end
  end

  if locations.include? :initializers
    self.initializers.each do |file_name, src|
      Brakeman.logger.spin
      finder.process_all_source src, :file => file_name
    end
  end

  @call_index.index_calls finder.calls
end

#report ⇒ Object

Returns a Report with this Tracker’s information



181
182
183
 
# File 'lib/brakeman/tracker.rb', line 181

def report
  Brakeman::Report.new(self)
end

#reset_all ⇒ Object 



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/brakeman/tracker.rb', line 35

def reset_all
  @templates = {}
  @controllers = {}

  #Initialize models with the unknown model so
  #we can match models later without knowing precisely what
  #class they are.
  @models = {}
  @models[UNKNOWN_MODEL] = Brakeman::Model.new(UNKNOWN_MODEL, nil, @app_tree.file_path("NOT_REAL.rb"), nil, self)

  @method_cache = {}
  @routes = {}
  @initializers = {}
  @errors = []
  @libs = {}
  @constants = Brakeman::Constants.new
  @checks = nil
  @processed = nil
  @template_cache = Set.new
  @filter_cache = {}
  @call_index = nil
  @config = Brakeman::Config.new(self)
  @start_time = Time.now
  @end_time = nil
  @duration = nil
end

#reset_controller(path) ⇒ Object 



400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
 
# File 'lib/brakeman/tracker.rb', line 400

def reset_controller path
  controller_name = nil

  #Remove from controller
  @controllers.each do |name, controller|
    if controller.files.include?(path)
      controller_name = name

      #Remove templates rendered from this controller
      @templates.each do |template_name, template|
        if template.render_path and template.render_path.include_controller? name
          reset_template template_name
          @call_index.remove_template_indexes template_name
        end
      end

      #Remove calls indexed from this controller
      @call_index.remove_indexes_by_class [name]
      break
    end
  end
  @controllers.delete controller_name
end

#reset_initializer(path) ⇒ Object 



429
430
431
432
433
434
435
 
# File 'lib/brakeman/tracker.rb', line 429

def reset_initializer path
  @initializers.delete_if do |file, src|
    path.relative.include? file
  end

  @call_index.remove_indexes_by_file path
end

#reset_lib(path) ⇒ Object

Clear information related to model



387
388
389
390
391
392
393
394
395
396
397
398
 
# File 'lib/brakeman/tracker.rb', line 387

def reset_lib path
  lib_name = nil

  @libs.each do |name, lib|
    if lib.files.include?(path)
      lib_name = name
      break
    end
  end

  @libs.delete lib_name
end

#reset_model(path) ⇒ Object

Clear information related to model



373
374
375
376
377
378
379
380
381
382
383
384
 
# File 'lib/brakeman/tracker.rb', line 373

def reset_model path
  model_name = nil

  @models.each do |name, model|
    if model.files.include?(path)
      model_name = name
      break
    end
  end

  @models.delete(model_name)
end

#reset_routes ⇒ Object

Clear information about routes



425
426
427
 
# File 'lib/brakeman/tracker.rb', line 425

def reset_routes
  @routes = {}
end

#reset_template(name) ⇒ Object

Clear information related to template



364
365
366
367
368
369
370
 
# File 'lib/brakeman/tracker.rb', line 364

def reset_template name
  name = name.to_sym
  @templates.delete name
  @processed = nil
  @rest = nil
  @template_cache.clear
end

#reset_templates(options = { :only_rendered => false }) ⇒ Object

Clear information related to templates. If :only_rendered => true, will delete templates rendered from controllers (but not those rendered from other templates)



350
351
352
353
354
355
356
357
358
359
360
361
 
# File 'lib/brakeman/tracker.rb', line 350

def reset_templates options = { :only_rendered => false }
  if options[:only_rendered]
    @templates.delete_if do |_name, template|
      template.rendered_from_controller?
    end
  else
    @templates = {}
  end
  @processed = nil
  @rest = nil
  @template_cache.clear
end

#run_checks ⇒ Object

Run a set of checks on the current information. Results will be stored in Tracker#checks.



92
93
94
95
96
97
98
 
# File 'lib/brakeman/tracker.rb', line 92

def run_checks
  @checks = Brakeman::Checks.run_checks(self)

  @end_time = Time.now
  @duration = @end_time - @start_time
  @checks
end

#save_file_cache! ⇒ Object 



62
63
64
 
# File 'lib/brakeman/tracker.rb', line 62

def save_file_cache!
  @pristine_file_cache = @file_cache.dup
end

#unused_fingerprints ⇒ Object 



199
200
201
202
 
# File 'lib/brakeman/tracker.rb', line 199

def unused_fingerprints
  return [] unless self.ignored_filter
  self.ignored_filter.obsolete_fingerprints
end

#warnings ⇒ Object 



185
186
187
 
# File 'lib/brakeman/tracker.rb', line 185

def warnings
  self.checks.all_warnings
end