Class: Brakeman::ErubisTemplateProcessor
- Inherits:
-
TemplateProcessor
- Object
- SexpProcessor
- BaseProcessor
- TemplateProcessor
- Brakeman::ErubisTemplateProcessor
- Defined in:
- lib/brakeman/processors/erubis_template_processor.rb
Overview
Processes ERB templates using Erubis instead of erb.
Constant Summary
Constants included from Util
Util::ALL_PARAMETERS, Util::COOKIES, Util::PARAMETERS, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION
Constants inherited from SexpProcessor
Instance Attribute Summary
Attributes inherited from BaseProcessor
Attributes inherited from SexpProcessor
Instance Method Summary collapse
-
#process_attrasgn(exp) ⇒ Object
Look for assignments to output buffer that look like this: @output_buffer.append = some_output @output_buffer.safe_append = some_output.
-
#process_block(exp) ⇒ Object
Process blocks, ignoring :ignore exps.
-
#process_call(exp) ⇒ Object
s(:call, TARGET, :method, s(:arglist)).
Methods inherited from TemplateProcessor
#initialize, #process, #process_escaped_output, #process_lasgn, #process_output
Methods inherited from BaseProcessor
#find_render_type, #initialize, #make_render, #make_render_in_view, #process_arglist, #process_class, #process_default, #process_dstr, #process_evstr, #process_hash, #process_if, #process_ignore, #process_iter, #process_lasgn, #process_scope
Methods included from Util
#array?, #call?, #camelize, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #node_type?, #number?, #params?, #pluralize, #regexp?, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #symbol?, #table_to_csv, #true?, #truncate_table, #underscore
Methods included from ProcessorHelper
#class_name, #process_all, #process_module
Methods inherited from SexpProcessor
#error_handler, #in_context, #initialize, #process, #process_dummy, #scope
Constructor Details
This class inherits a constructor from Brakeman::TemplateProcessor
Instance Method Details
#process_attrasgn(exp) ⇒ Object
Look for assignments to output buffer that look like this:
@output_buffer.append = some_output
@output_buffer.safe_append = some_output
76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 |
# File 'lib/brakeman/processors/erubis_template_processor.rb', line 76 def process_attrasgn exp if exp.target.node_type == :ivar and exp.target.value == :@output_buffer if exp.method == :append= or exp.method == :safe_append= arg = exp.first_arg = process(exp.first_arg) if arg.node_type == :str ignore else s = Sexp.new :escaped_output, arg s.line(exp.line) @current_template[:outputs] << s s end else super end else super end end |
#process_block(exp) ⇒ Object
Process blocks, ignoring :ignore exps
58 59 60 61 62 63 64 65 66 67 68 69 70 71 |
# File 'lib/brakeman/processors/erubis_template_processor.rb', line 58 def process_block exp exp.shift exp.map! do |e| res = process e if res.empty? or res == ignore nil else res end end block = Sexp.new(:rlist).concat(exp).compact block.line(exp.line) block end |
#process_call(exp) ⇒ Object
s(:call, TARGET, :method, s(:arglist))
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 |
# File 'lib/brakeman/processors/erubis_template_processor.rb', line 7 def process_call exp target = exp.target if sexp? target target = process target end method = exp.method #_buf is the default output variable for Erubis if node_type?(target, :lvar, :ivar) and (target.value == :_buf or target.value == :@output_buffer) if method == :<< or method == :safe_concat exp.arglist = process exp.arglist arg = exp.first_arg #We want the actual content if arg.node_type == :call and (arg.method == :to_s or arg.method == :html_safe!) arg = arg.target end if arg.node_type == :str #ignore plain strings ignore elsif node_type? target, :ivar and target.value == :@output_buffer s = Sexp.new :escaped_output, arg s.line(exp.line) @current_template[:outputs] << s s else s = Sexp.new :output, arg s.line(exp.line) @current_template[:outputs] << s s end elsif method == :to_s ignore else abort "Unrecognized action on buffer: #{method}" end elsif target == nil and method == :render exp.arglist = process exp.arglist make_render_in_view exp else #TODO: Is it really necessary to create a new Sexp here? args = exp.arglist = process(exp.arglist) call = Sexp.new :call, target, method, args call.original_line(exp.original_line) call.line(exp.line) call end end |