Class: Brakeman::Scanner

Inherits:
Object show all
Defined in:
lib/brakeman/scanner.rb

Overview

Scans the Rails application.

Direct Known Subclasses

Rescanner

Constant Summary collapse

RUBY_1_9 = 
!!(RUBY_VERSION =~ /^1\.9/)
KNOWN_TEMPLATE_EXTENSIONS = 
/.*\.(erb|haml|rhtml)$/

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(options, processor = nil) ⇒ Scanner

Pass in path to the root of the Rails application



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/brakeman/scanner.rb', line 35

def initialize options, processor = nil
  @options = options
  @report_progress = options[:report_progress]
  @path = options[:app_path]
  @app_path = File.join(@path, "app")
  @processor = processor || Brakeman::Processor.new(options)
  @skip_files = nil

  #Convert files into Regexp for matching
  if options[:skip_files]
    list = "(?:" << options[:skip_files].map { |f| Regexp.escape f }.join("|") << ")$"
    @skip_files = Regexp.new(list)
  end

  if RUBY_1_9
    @ruby_parser = ::Ruby19Parser
  else
    @ruby_parser = ::RubyParser
  end
end

Instance Attribute Details

#options ⇒ Object (readonly)

Returns the value of attribute options.



29
30
31
 
# File 'lib/brakeman/scanner.rb', line 29

def options
  @options
end

Instance Method Details

#index_call_sites ⇒ Object 



380
381
382
 
# File 'lib/brakeman/scanner.rb', line 380

def index_call_sites
  tracker.index_call_sites
end

#parse_ruby(input) ⇒ Object 



384
385
386
 
# File 'lib/brakeman/scanner.rb', line 384

def parse_ruby input
  @ruby_parser.new.parse input
end

#process ⇒ Object

Process everything in the Rails application



62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'lib/brakeman/scanner.rb', line 62

def process
  Brakeman.notify "Processing configuration..."
  process_config
  Brakeman.notify "Processing gems..."
  process_gems
  Brakeman.notify "Processing initializers..."
  process_initializers
  Brakeman.notify "Processing libs..."
  process_libs
  Brakeman.notify "Processing routes...          "
  process_routes
  Brakeman.notify "Processing templates...       "
  process_templates
  Brakeman.notify "Processing models...          "
  process_models
  Brakeman.notify "Processing controllers...     "
  process_controllers
  Brakeman.notify "Indexing call sites...        "
  index_call_sites
  tracker
end

#process_config ⇒ Object

Process config/environment.rb and config/gems.rb

Stores parsed information in tracker.config



87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
 
# File 'lib/brakeman/scanner.rb', line 87

def process_config
  if options[:rails3]
    process_config_file "application.rb"
    process_config_file "environments/production.rb"
  else
    process_config_file "environment.rb"
    process_config_file "gems.rb"
  end

  if File.exists? "#@path/vendor/plugins/rails_xss" or
    options[:rails3] or options[:escape_html]

    tracker.config[:escape_html] = true
    Brakeman.notify "[Notice] Escaping HTML by default"
  end
end

#process_controller(path) ⇒ Object 



246
247
248
249
250
251
252
253
254
 
# File 'lib/brakeman/scanner.rb', line 246

def process_controller path
  begin
    @processor.process_controller(parse_ruby(File.read(path)), path)
  rescue Racc::ParseError => e
    tracker.error e, "could not parse #{path}. There is probably a typo in the file. Test it with 'ruby_parse #{path}'"
  rescue Exception => e
    tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
  end
end

#process_controllers ⇒ Object

Process all .rb files in controllers/

Adds processed controllers to tracker.controllers



210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
 
# File 'lib/brakeman/scanner.rb', line 210

def process_controllers
  controller_files = Dir.glob(@app_path + "/controllers/**/*.rb").sort
  controller_files.reject! { |f| @skip_files.match f } if @skip_files

  total = controller_files.length
  current = 0

  controller_files.each do |f|
    Brakeman.debug "Processing #{f}"
    if @report_progress
      $stderr.print " #{current}/#{total} files processed\r"
      current += 1
    end

    process_controller f
  end

  current = 0
  total = tracker.controllers.length

  Brakeman.notify "Processing data flow in controllers..."

  tracker.controllers.sort_by{|name| name.to_s}.each do |name, controller|
    Brakeman.debug "Processing #{name}"
    if @report_progress
      $stderr.print " #{current}/#{total} controllers processed\r"
      current += 1
    end

    @processor.process_controller_alias name, controller[:src]
  end

  #No longer need these processed filter methods
  tracker.filter_cache.clear
end

#process_gems ⇒ Object

Process Gemfile



117
118
119
120
121
122
123
124
125
126
127
128
 
# File 'lib/brakeman/scanner.rb', line 117

def process_gems
  if File.exists? "#@path/Gemfile"
    if File.exists? "#@path/Gemfile.lock"
      @processor.process_gems(parse_ruby(File.read("#@path/Gemfile")), File.read("#@path/Gemfile.lock"))
    else
      @processor.process_gems(parse_ruby(File.read("#@path/Gemfile")))
    end
  end
rescue Exception => e
  Brakeman.notify "[Notice] Error while processing Gemfile."
  tracker.error e.exception(e.message + "\nWhile processing Gemfile"), e.backtrace
end

#process_initializer(path) ⇒ Object

Process an initializer



143
144
145
146
147
148
149
150
151
 
# File 'lib/brakeman/scanner.rb', line 143

def process_initializer path
  begin
    @processor.process_initializer(path, parse_ruby(File.read(path)))
  rescue Racc::ParseError => e
    tracker.error e, "could not parse #{path}. There is probably a typo in the file. Test it with 'ruby_parse #{path}'"
  rescue Exception => e
    tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
  end
end

#process_initializers ⇒ Object

Process all the .rb files in config/initializers/

Adds parsed information to tracker.initializers



133
134
135
136
137
138
139
140
 
# File 'lib/brakeman/scanner.rb', line 133

def process_initializers
  initializer_files = Dir.glob(@path + "/config/initializers/**/*.rb").sort
  initializer_files.reject! { |f| @skip_files.match f } if @skip_files

  initializer_files.each do |f|
    process_initializer f
  end
end

#process_lib(path) ⇒ Object

Process a library



180
181
182
183
184
185
186
187
188
 
# File 'lib/brakeman/scanner.rb', line 180

def process_lib path
  begin
    @processor.process_lib parse_ruby(File.read(path)), path
  rescue Racc::ParseError => e
    tracker.error e, "could not parse #{path}. There is probably a typo in the file. Test it with 'ruby_parse #{path}'"
  rescue Exception => e
    tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
  end
end

#process_libs ⇒ Object

Process all .rb in lib/

Adds parsed information to tracker.libs.



156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
 
# File 'lib/brakeman/scanner.rb', line 156

def process_libs
  if options[:skip_libs]
    Brakeman.notify '[Skipping]'
    return
  end

  lib_files = Dir.glob(@path + "/lib/**/*.rb").sort
  lib_files.reject! { |f| @skip_files.match f } if @skip_files

  total = lib_files.length
  current = 0

  lib_files.each do |f|
    Brakeman.debug "Processing #{f}"
    if @report_progress
      $stderr.print " #{current}/#{total} files processed\r"
      current += 1
    end

    process_lib f
  end
end

#process_model(path) ⇒ Object 



370
371
372
373
374
375
376
377
378
 
# File 'lib/brakeman/scanner.rb', line 370

def process_model path
  begin
    @processor.process_model(parse_ruby(File.read(path)), path)
  rescue Racc::ParseError => e
    tracker.error e, "could not parse #{path}"
  rescue Exception => e
    tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
  end
end

#process_models ⇒ Object

Process all the .rb files in models/

Adds the processed models to tracker.models



351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
 
# File 'lib/brakeman/scanner.rb', line 351

def process_models
  model_files = Dir.glob(@app_path + "/models/**/*.rb").sort
  model_files.reject! { |f| @skip_files.match f } if @skip_files

  total = model_files.length
  current = 0

  model_files.each do |f|
    Brakeman.debug "Processing #{f}"
    if @report_progress
      $stderr.print " #{current}/#{total} files processed\r"
      current += 1
    end

    process_model f

  end
end

#process_routes ⇒ Object

Process config/routes.rb

Adds parsed information to tracker.routes



193
194
195
196
197
198
199
200
201
202
203
204
205
 
# File 'lib/brakeman/scanner.rb', line 193

def process_routes
  if File.exists? "#@path/config/routes.rb"
    begin
      @processor.process_routes parse_ruby(File.read("#@path/config/routes.rb"))
    rescue Exception => e
      tracker.error e.exception(e.message + "\nWhile processing routes.rb"), e.backtrace
      Brakeman.notify "[Notice] Error while processing routes - assuming all public controller methods are actions."
      options[:assume_all_routes] = true
    end
  else
    Brakeman.notify "[Notice] No route information found"
  end
end

#process_template(path) ⇒ Object 



296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
 
# File 'lib/brakeman/scanner.rb', line 296

def process_template path
  type = path.match(KNOWN_TEMPLATE_EXTENSIONS)[1].to_sym
  type = :erb if type == :rhtml
  name = template_path_to_name path
  text = File.read path

  begin
    if type == :erb
      if tracker.config[:escape_html]
        type = :erubis
        if options[:rails3]
          src = Brakeman::Rails3Erubis.new(text).src
        else
          src = Brakeman::Rails2XSSPluginErubis.new(text).src
        end
      elsif tracker.config[:erubis]
        type = :erubis
        src = Brakeman::ScannerErubis.new(text).src
      else
        src = ERB.new(text, nil, "-").src
        src.sub!(/^#.*\n/, '') if RUBY_1_9
      end

      parsed = parse_ruby src
    elsif type == :haml
      src = Haml::Engine.new(text,
                             :escape_html => !!tracker.config[:escape_html]).precompiled
      parsed = parse_ruby src
    else
      tracker.error "Unkown template type in #{path}"
    end

    @processor.process_template(name, parsed, type, nil, path)

  rescue Racc::ParseError => e
    tracker.error e, "could not parse #{path}"
  rescue Haml::Error => e
    tracker.error e, ["While compiling HAML in #{path}"] << e.backtrace
  rescue Exception => e
    tracker.error e.exception(e.message + "\nWhile processing #{path}"), e.backtrace
  end
end

#process_templates ⇒ Object

Process all views and partials in views/

Adds processed views to tracker.views



259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
 
# File 'lib/brakeman/scanner.rb', line 259

def process_templates

  views_path = @app_path + "/views/**/*.{html.erb,html.haml,rhtml,js.erb}"
  $stdout.sync = true
  count = 0

  template_files = Dir.glob(views_path).sort
  template_files.reject! { |f| @skip_files.match f } if @skip_files

  total = template_files.length

  template_files.each do |path|
    Brakeman.debug "Processing #{path}"
    if @report_progress
      $stderr.print " #{count}/#{total} files processed\r"
      count += 1
    end

    process_template path
  end

  total = tracker.templates.length
  count = 0

  Brakeman.notify "Processing data flow in templates..."

  tracker.templates.keys.dup.sort_by{|name| name.to_s}.each do |name|
    Brakeman.debug "Processing #{name}"
    if @report_progress
      count += 1
      $stderr.print " #{count}/#{total} templates processed\r"
    end

    @processor.process_template_alias tracker.templates[name]
  end
end

#template_path_to_name(path) ⇒ Object

Convert path/filename to view name

views/test/something.html.erb -> test/something



342
343
344
345
346
 
# File 'lib/brakeman/scanner.rb', line 342

def template_path_to_name path
  names = path.split("/")
  names.last.gsub!(/(\.(html|js)\..*|\.rhtml)$/, '')
  names[(names.index("views") + 1)..-1].join("/").to_sym
end

#tracker ⇒ Object

Returns the Tracker generated from the scan



57
58
59
 
# File 'lib/brakeman/scanner.rb', line 57

def tracker
  @processor.tracked_events
end