Class: Brakeman::ControllerProcessor

Inherits:
BaseProcessor show all
Defined in:
lib/brakeman/processors/controller_processor.rb

Overview

Processes controller. Results are put in tracker.controllers

Constant Summary collapse

FORMAT_HTML = 
Sexp.new(:call, Sexp.new(:lvar, :format), :html, Sexp.new(:arglist))

Constants included from Util

Util::ALL_PARAMETERS, Util::COOKIES, Util::PARAMETERS, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION

Constants inherited from SexpProcessor

SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from BaseProcessor

#ignore

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods inherited from BaseProcessor

#find_render_type, #make_render, #make_render_in_view, #process_arglist, #process_attrasgn, #process_block, #process_default, #process_dstr, #process_evstr, #process_hash, #process_if, #process_ignore, #process_lasgn, #process_scope

Methods included from Util

#array?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #node_type?, #number?, #params?, #pluralize, #regexp?, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#class_name, #process_all, #process_module

Methods inherited from SexpProcessor

#error_handler, #in_context, #process, #process_dummy, #scope

Constructor Details

#initialize(tracker) ⇒ ControllerProcessor

Returns a new instance of ControllerProcessor.



7
8
9
10
11
12
13
14
 
# File 'lib/brakeman/processors/controller_processor.rb', line 7

def initialize tracker
  super 
  @controller = nil
  @current_method = nil
  @current_module = nil
  @visibility = :public
  @file_name = nil
end

Instance Method Details

#add_fake_filter(exp) ⇒ Object

This is to handle before_filter do |controller| … end

We build a new method and process that the same way as usual methods and filters.



187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
 
# File 'lib/brakeman/processors/controller_processor.rb', line 187

def add_fake_filter exp
  filter_name = ("fake_filter" + rand.to_s[/\d+$/]).to_sym
  args = exp.block_call.arglist
  args.insert(1, Sexp.new(:lit, filter_name))
  before_filter_call = Sexp.new(:call, nil, :before_filter, args)

  if exp.block_args
    block_variable = exp.block_args[1]
  else
    block_variable = :temp
  end

  if node_type? exp.block, :block
    block_inner = exp.block[1..-1]
  else
    block_inner = [exp.block]
  end

  #Build Sexp for filter method
  body = Sexp.new(:scope, 
          Sexp.new(:block,
            Sexp.new(:lasgn, block_variable, 
              Sexp.new(:call, Sexp.new(:const, @controller[:name]), :new, Sexp.new(:arglist)))).concat(block_inner))

  filter_method = Sexp.new(:defn, filter_name, Sexp.new(:args), body).line(exp.line)

  vis = @visibility
  @visibility = :private
  process_defn filter_method
  @visibility = vis
  process before_filter_call
  exp
end

#process_call(exp) ⇒ Object

Look for specific calls inside the controller



59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/brakeman/processors/controller_processor.rb', line 59

def process_call exp
  target = exp.target
  if sexp? target
    target = process target
  end

  method = exp.method
  args = exp.args

  #Methods called inside class definition
  #like attr_* and other settings
  if @current_method.nil? and target.nil? and @controller
    if args.empty?
      case method
      when :private, :protected, :public
        @visibility = method
      when :protect_from_forgery
        @controller[:options][:protect_from_forgery] = true
      else
        #??
      end
    else
      case method
      when :include
        @controller[:includes] << class_name(args.first) if @controller
      when :before_filter
        @controller[:options][:before_filters] ||= []
        @controller[:options][:before_filters] << args
      when :layout
        if string? args.last
          #layout "some_layout"

          name = args.last.value.to_s
          unless Dir.glob("#{@tracker.options[:app_path]}/app/views/layouts/#{name}.html.{erb,haml}").empty?
            @controller[:layout] = "layouts/#{name}"
          else
            Brakeman.debug "[Notice] Layout not found: #{name}"
          end
        elsif node_type? args.last, :nil, :false
          #layout :false or layout nil
          @controller[:layout] = false
        end
      else
        @controller[:options][method] ||= []
        @controller[:options][method] << exp
      end
    end

    exp
  elsif target == nil and method == :render
    make_render exp
  elsif exp == FORMAT_HTML and context[1] != :iter 
    #This is an empty call to
    # format.html
    #Which renders the default template if no arguments
    #Need to make more generic, though.
    call = Sexp.new :render, :default, @current_method
    call.line(exp.line)
    call
  else
    call = Sexp.new :call, target, method, process(exp.arglist) #RP 3 TODO
    call.line(exp.line)
    call
  end
end

#process_class(exp) ⇒ Object

s(:class, NAME, PARENT, s(:scope …))



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/brakeman/processors/controller_processor.rb', line 23

def process_class exp
  name = class_name(exp.class_name)

  if @controller
    Brakeman.debug "[Notice] Skipping inner class: #{name}"
    return ignore
  end

  if @current_module
    name = (@current_module.to_s + "::" + name.to_s).to_sym
  end

  begin
    parent = class_name exp.parent_name
  rescue StandardError => e
    Brakeman.debug e
    parent = nil
  end

  @controller = { :name => name,
                  :parent => parent,
                  :includes => [],
                  :public => {},
                  :private => {},
                  :protected => {},
                  :options => {},
                  :src => exp,
                  :file => @file_name }
  @tracker.controllers[@controller[:name]] = @controller
  exp.body = process exp.body
  set_layout_name
  @controller = nil
  exp
end

#process_controller(src, file_name = nil) ⇒ Object

Use this method to process a Controller



17
18
19
20
 
# File 'lib/brakeman/processors/controller_processor.rb', line 17

def process_controller src, file_name = nil
  @file_name = file_name
  process src
end

#process_defn(exp) ⇒ Object

Process method definition and store in Tracker



126
127
128
129
130
131
132
133
134
135
 
# File 'lib/brakeman/processors/controller_processor.rb', line 126

def process_defn exp
  name = exp.method_name
  @current_method = name
  res = Sexp.new :methdef, name, process(exp[2]), process(exp.body.block)
  res.line(exp.line)
  @current_method = nil
  @controller[@visibility][name] = res unless @controller.nil?

  res
end

#process_defs(exp) ⇒ Object

Process self.method definition and store in Tracker



138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
 
# File 'lib/brakeman/processors/controller_processor.rb', line 138

def process_defs exp
  name = exp.method_name

  if exp[1].node_type == :self
    if @controller
      target = @controller[:name]
    elsif @current_module
      target = @current_module
    else
      target = nil
    end
  else
    target = class_name exp[1]
  end

  @current_method = name
  res = Sexp.new :selfdef, target, name, process(exp[3]), process(exp.body.block)
  res.line(exp.line)
  @current_method = nil
  @controller[@visibility][name] = res unless @controller.nil?

  res
end

#process_iter(exp) ⇒ Object

Look for before_filters and add fake ones if necessary



163
164
165
166
167
168
169
 
# File 'lib/brakeman/processors/controller_processor.rb', line 163

def process_iter exp
  if exp.block_call.method == :before_filter
    add_fake_filter exp
  else
    super
  end
end

#set_layout_name ⇒ Object

Sets default layout for renders inside Controller



172
173
174
175
176
177
178
179
180
181
 
# File 'lib/brakeman/processors/controller_processor.rb', line 172

def set_layout_name
  return if @controller[:layout]

  name = underscore(@controller[:name].to_s.split("::")[-1].gsub("Controller", ''))

  #There is a layout for this Controller
  unless Dir.glob("#{@tracker.options[:app_path]}/app/views/layouts/#{name}.html.{erb,haml}").empty?
    @controller[:layout] = "layouts/#{name}"
  end
end