Class: Brakeman::Scanner
- Inherits:
-
Object
- Object
- Brakeman::Scanner
- Defined in:
- lib/brakeman/scanner.rb
Overview
Scans the Rails application.
Direct Known Subclasses
Instance Attribute Summary collapse
-
#options ⇒ Object
readonly
Returns the value of attribute options.
Instance Method Summary collapse
- #detect_file_types ⇒ Object
-
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile.
- #index_call_sites ⇒ Object
-
#initialize(options, processor = nil) ⇒ Scanner
constructor
Pass in path to the root of the Rails application.
- #parse_files ⇒ Object
- #parse_ruby_file(file) ⇒ Object
-
#process ⇒ Object
Process everything in the Rails application.
-
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb.
- #process_controller(astfile) ⇒ Object
- #process_controller_data_flows ⇒ Object
-
#process_controllers ⇒ Object
Process all .rb files in controllers/.
-
#process_gems ⇒ Object
Process Gemfile.
-
#process_initializer(init) ⇒ Object
Process an initializer.
-
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/.
-
#process_lib(lib) ⇒ Object
Process a library.
-
#process_libs ⇒ Object
Process all .rb in lib/.
- #process_model(path, ast) ⇒ Object
-
#process_models ⇒ Object
Process all the .rb files in models/.
-
#process_routes ⇒ Object
Process config/routes.rb.
- #process_template(template) ⇒ Object
- #process_template_data_flows ⇒ Object
-
#process_templates ⇒ Object
Process all views and partials in views/.
- #report_progress(current, total, type = "files") ⇒ Object
- #track_progress(list, type = "files") ⇒ Object
-
#tracker ⇒ Object
Returns the Tracker generated from the scan.
Constructor Details
#initialize(options, processor = nil) ⇒ Scanner
Pass in path to the root of the Rails application
21 22 23 24 25 26 27 28 29 30 31 32 33 |
# File 'lib/brakeman/scanner.rb', line 21 def initialize , processor = nil @options = @app_tree = Brakeman::AppTree.() if (!@app_tree.root || !@app_tree.exists?("app")) && ![:force_scan] = "Please supply the path to a Rails application (looking in #{@app_tree.root}).\n" << " Use `--force` to run a scan anyway." raise Brakeman::NoApplication, end @processor = processor || Brakeman::Processor.new(@app_tree, ) end |
Instance Attribute Details
#options ⇒ Object (readonly)
Returns the value of attribute options.
18 19 20 |
# File 'lib/brakeman/scanner.rb', line 18 def @options end |
Instance Method Details
#detect_file_types ⇒ Object
89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 |
# File 'lib/brakeman/scanner.rb', line 89 def detect_file_types @file_list = { controllers: [], initializers: [], libs: [], models: [], templates: [], } detector = Brakeman::FileTypeDetector.new @parsed_files.each do |file| if file.is_a? Brakeman::TemplateParser::TemplateFile @file_list[:templates] << file else type = detector.detect_type(file) unless type == :skip if @file_list[type].nil? raise type.to_s else @file_list[type] << file end end end end end |
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile
194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 |
# File 'lib/brakeman/scanner.rb', line 194 def guess_rails_version unless tracker.[:rails3] or tracker.[:rails4] if @app_tree.exists?("script/rails") tracker.[:rails3] = true Brakeman.notify "[Notice] Detected Rails 3 application" elsif @app_tree.exists?("app/channels") tracker.[:rails3] = true tracker.[:rails4] = true tracker.[:rails5] = true Brakeman.notify "[Notice] Detected Rails 5 application" elsif not @app_tree.exists?("script") tracker.[:rails3] = true tracker.[:rails4] = true Brakeman.notify "[Notice] Detected Rails 4 application" end end end |
#index_call_sites ⇒ Object
350 351 352 |
# File 'lib/brakeman/scanner.rb', line 350 def index_call_sites tracker.index_call_sites end |
#parse_files ⇒ Object
72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 |
# File 'lib/brakeman/scanner.rb', line 72 def parse_files fp = Brakeman::FileParser.new(tracker.app_tree, tracker.[:parser_timeout], tracker.[:parallel_checks]) fp.parse_files tracker.app_tree.ruby_file_paths template_parser = Brakeman::TemplateParser.new(tracker, fp) fp.read_files(@app_tree.template_paths) do |path, contents| template_parser.parse_template path, contents end # Collect errors raised during parsing tracker.add_errors(fp.errors) @parsed_files = fp.file_list end |
#parse_ruby_file(file) ⇒ Object
354 355 356 357 358 359 360 |
# File 'lib/brakeman/scanner.rb', line 354 def parse_ruby_file file fp = Brakeman::FileParser.new(tracker.app_tree, tracker.[:parser_timeout]) fp.parse_ruby(file.read, file) rescue Exception => e tracker.error(e) nil end |
#process ⇒ Object
Process everything in the Rails application
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 |
# File 'lib/brakeman/scanner.rb', line 41 def process Brakeman.notify "Processing gems... " process_gems guess_rails_version Brakeman.notify "Processing configuration... " process_config Brakeman.notify "Parsing files... " parse_files Brakeman.notify "Detecting file types... " detect_file_types Brakeman.notify "Processing initializers... " process_initializers Brakeman.notify "Processing libs... " process_libs Brakeman.notify "Processing routes... " process_routes Brakeman.notify "Processing templates... " process_templates Brakeman.notify "Processing data flow in templates... " process_template_data_flows Brakeman.notify "Processing models... " process_models Brakeman.notify "Processing controllers... " process_controllers Brakeman.notify "Processing data flow in controllers..." process_controller_data_flows Brakeman.notify "Indexing call sites... " index_call_sites tracker end |
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb
Stores parsed information in tracker.config
119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 |
# File 'lib/brakeman/scanner.rb', line 119 def process_config # Sometimes folks like to put constants in environment.rb # so let's always process it even for newer Rails versions process_config_file "environment.rb" if [:rails3] or [:rails4] or [:rails5] or [:rails6] process_config_file "application.rb" process_config_file "environments/production.rb" else process_config_file "gems.rb" end if @app_tree.exists?("vendor/plugins/rails_xss") or [:rails3] or [:escape_html] tracker.config.escape_html = true Brakeman.notify "[Notice] Escaping HTML by default" end if @app_tree.exists? ".ruby-version" if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/] tracker.config.set_ruby_version version, @app_tree.file_path(".ruby-version"), 1 end end tracker.config.load_rails_defaults end |
#process_controller(astfile) ⇒ Object
288 289 290 291 292 293 294 |
# File 'lib/brakeman/scanner.rb', line 288 def process_controller astfile begin @processor.process_controller(astfile.ast, astfile.path) rescue => e tracker.error e.exception(e. + "\nWhile processing #{astfile.path}"), e.backtrace end end |
#process_controller_data_flows ⇒ Object
274 275 276 277 278 279 280 281 282 283 284 285 286 |
# File 'lib/brakeman/scanner.rb', line 274 def process_controller_data_flows controllers = tracker.controllers.sort_by { |name, _| name.to_s } track_progress controllers, "controllers" do |name, controller| Brakeman.debug "Processing #{name}" controller.src.each do |file, src| @processor.process_controller_alias name, src, nil, file end end #No longer need these processed filter methods tracker.filter_cache.clear end |
#process_controllers ⇒ Object
Process all .rb files in controllers/
Adds processed controllers to tracker.controllers
267 268 269 270 271 272 |
# File 'lib/brakeman/scanner.rb', line 267 def process_controllers track_progress @file_list[:controllers] do |controller| Brakeman.debug "Processing #{controller.path}" process_controller controller end end |
#process_gems ⇒ Object
Process Gemfile
162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 |
# File 'lib/brakeman/scanner.rb', line 162 def process_gems gem_files = {} if @app_tree.exists? "Gemfile" file = @app_tree.file_path("Gemfile") gem_files[:gemfile] = { :src => parse_ruby_file(file), :file => file } elsif @app_tree.exists? "gems.rb" file = @app_tree.file_path("gems.rb") gem_files[:gemfile] = { :src => parse_ruby_file(file), :file => file } end if @app_tree.exists? "Gemfile.lock" file = @app_tree.file_path("Gemfile.lock") gem_files[:gemlock] = { :src => file.read, :file => file } elsif @app_tree.exists? "gems.locked" file = @app_tree.file_path("gems.locked") gem_files[:gemlock] = { :src => file.read, :file => file } end if @app_tree.gemspec gem_files[:gemspec] = { :src => parse_ruby_file(@app_tree.gemspec), :file => @app_tree.gemspec } end if not gem_files.empty? @processor.process_gems gem_files end rescue => e Brakeman.notify "[Notice] Error while processing Gemfile." tracker.error e.exception(e. + "\nWhile processing Gemfile"), e.backtrace end |
#process_initializer(init) ⇒ Object
Process an initializer
223 224 225 |
# File 'lib/brakeman/scanner.rb', line 223 def process_initializer init @processor.process_initializer(init.path, init.ast) end |
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/
Adds parsed information to tracker.initializers
215 216 217 218 219 220 |
# File 'lib/brakeman/scanner.rb', line 215 def process_initializers track_progress @file_list[:initializers] do |init| Brakeman.debug "Processing #{init[:path]}" process_initializer init end end |
#process_lib(lib) ⇒ Object
Process a library
243 244 245 |
# File 'lib/brakeman/scanner.rb', line 243 def process_lib lib @processor.process_lib lib.ast, lib.path end |
#process_libs ⇒ Object
Process all .rb in lib/
Adds parsed information to tracker.libs.
230 231 232 233 234 235 236 237 238 239 240 |
# File 'lib/brakeman/scanner.rb', line 230 def process_libs if [:skip_libs] Brakeman.notify '[Skipping]' return end track_progress @file_list[:libs] do |lib| Brakeman.debug "Processing #{lib.path}" process_lib lib end end |
#process_model(path, ast) ⇒ Object
331 332 333 |
# File 'lib/brakeman/scanner.rb', line 331 def process_model path, ast @processor.process_model(ast, path) end |
#process_models ⇒ Object
Process all the .rb files in models/
Adds the processed models to tracker.models
324 325 326 327 328 329 |
# File 'lib/brakeman/scanner.rb', line 324 def process_models track_progress @file_list[:models] do |model| Brakeman.debug "Processing #{model[:path]}" process_model model[:path], model[:ast] end end |
#process_routes ⇒ Object
Process config/routes.rb
Adds parsed information to tracker.routes
250 251 252 253 254 255 256 257 258 259 260 261 262 |
# File 'lib/brakeman/scanner.rb', line 250 def process_routes if @app_tree.exists?("config/routes.rb") file = @app_tree.file_path("config/routes.rb") if routes_sexp = parse_ruby_file(file) @processor.process_routes routes_sexp else Brakeman.notify "[Notice] Error while processing routes - assuming all public controller methods are actions." [:assume_all_routes] = true end else Brakeman.notify "[Notice] No route information found" end end |
#process_template(template) ⇒ Object
308 309 310 |
# File 'lib/brakeman/scanner.rb', line 308 def process_template template @processor.process_template(template.name, template.ast, template.type, nil, template.path) end |
#process_template_data_flows ⇒ Object
312 313 314 315 316 317 318 319 |
# File 'lib/brakeman/scanner.rb', line 312 def process_template_data_flows templates = tracker.templates.sort_by { |name, _| name.to_s } track_progress templates, "templates" do |name, template| Brakeman.debug "Processing #{name}" @processor.process_template_alias template end end |
#process_templates ⇒ Object
Process all views and partials in views/
Adds processed views to tracker.views
299 300 301 302 303 304 305 306 |
# File 'lib/brakeman/scanner.rb', line 299 def process_templates templates = @file_list[:templates].sort_by { |t| t[:path] } track_progress templates, "templates" do |template| Brakeman.debug "Processing #{template[:path]}" process_template template end end |
#report_progress(current, total, type = "files") ⇒ Object
345 346 347 348 |
# File 'lib/brakeman/scanner.rb', line 345 def report_progress(current, total, type = "files") return unless @options[:report_progress] $stderr.print " #{current}/#{total} #{type} processed\r" end |
#track_progress(list, type = "files") ⇒ Object
335 336 337 338 339 340 341 342 343 |
# File 'lib/brakeman/scanner.rb', line 335 def track_progress list, type = "files" total = list.length current = 0 list.each do |item| report_progress current, total, type current += 1 yield item end end |
#tracker ⇒ Object
Returns the Tracker generated from the scan
36 37 38 |
# File 'lib/brakeman/scanner.rb', line 36 def tracker @processor.tracked_events end |