Class: Brakeman::Scanner
Overview
Scans the Rails application.
Direct Known Subclasses
Constant Summary collapse
- RUBY_1_9 =
RUBY_VERSION >= "1.9.0"
Instance Attribute Summary collapse
-
#options ⇒ Object
readonly
Returns the value of attribute options.
Instance Method Summary collapse
-
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile.
- #index_call_sites ⇒ Object
-
#initialize(options, processor = nil) ⇒ Scanner
constructor
Pass in path to the root of the Rails application.
- #parse_files ⇒ Object
- #parse_ruby(input) ⇒ Object
-
#process ⇒ Object
Process everything in the Rails application.
-
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb.
- #process_controller(astfile) ⇒ Object
- #process_controller_data_flows ⇒ Object
-
#process_controllers ⇒ Object
Process all .rb files in controllers/.
-
#process_gems ⇒ Object
Process Gemfile.
-
#process_initializer(init) ⇒ Object
Process an initializer.
-
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/.
-
#process_lib(lib) ⇒ Object
Process a library.
-
#process_libs ⇒ Object
Process all .rb in lib/.
- #process_model(path, ast) ⇒ Object
-
#process_models ⇒ Object
Process all the .rb files in models/.
-
#process_routes ⇒ Object
Process config/routes.rb.
- #process_template(template) ⇒ Object
- #process_template_data_flows ⇒ Object
-
#process_templates ⇒ Object
Process all views and partials in views/.
- #report_progress(current, total, type = "files") ⇒ Object
- #track_progress(list, type = "files") ⇒ Object
-
#tracker ⇒ Object
Returns the Tracker generated from the scan.
Constructor Details
#initialize(options, processor = nil) ⇒ Scanner
Pass in path to the root of the Rails application
23 24 25 26 27 28 29 30 31 32 |
# File 'lib/brakeman/scanner.rb', line 23 def initialize , processor = nil @options = @app_tree = Brakeman::AppTree.() if !@app_tree.root || !@app_tree.exists?("app") raise Brakeman::NoApplication, "Please supply the path to a Rails application." end @processor = processor || Brakeman::Processor.new(@app_tree, ) end |
Instance Attribute Details
#options ⇒ Object (readonly)
Returns the value of attribute options.
19 20 21 |
# File 'lib/brakeman/scanner.rb', line 19 def @options end |
Instance Method Details
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile
144 145 146 147 148 149 150 151 152 153 154 155 |
# File 'lib/brakeman/scanner.rb', line 144 def guess_rails_version unless tracker.[:rails3] or tracker.[:rails4] if @app_tree.exists?("script/rails") tracker.[:rails3] = true Brakeman.notify "[Notice] Detected Rails 3 application" elsif not @app_tree.exists?("script") tracker.[:rails3] = true # Probably need to do some refactoring tracker.[:rails4] = true Brakeman.notify "[Notice] Detected Rails 4 application" end end end |
#index_call_sites ⇒ Object
295 296 297 |
# File 'lib/brakeman/scanner.rb', line 295 def index_call_sites tracker.index_call_sites end |
#parse_files ⇒ Object
69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 |
# File 'lib/brakeman/scanner.rb', line 69 def parse_files fp = Brakeman::FileParser.new tracker, @app_tree files = { :initializers => @app_tree.initializer_paths, :controllers => @app_tree.controller_paths, :models => @app_tree.model_paths } unless [:skip_libs] files[:libs] = @app_tree.lib_paths end files.each do |name, paths| fp.parse_files paths, name end template_parser = Brakeman::TemplateParser.new(tracker, fp) fp.read_files(@app_tree.template_paths, :templates) do |path, contents| template_parser.parse_template path, contents end @file_list = fp.file_list end |
#parse_ruby(input) ⇒ Object
299 300 301 |
# File 'lib/brakeman/scanner.rb', line 299 def parse_ruby input RubyParser.new.parse input end |
#process ⇒ Object
Process everything in the Rails application
40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 |
# File 'lib/brakeman/scanner.rb', line 40 def process Brakeman.notify "Processing gems..." process_gems guess_rails_version Brakeman.notify "Processing configuration..." process_config Brakeman.notify "Parsing files..." parse_files Brakeman.notify "Processing initializers..." process_initializers Brakeman.notify "Processing libs..." process_libs Brakeman.notify "Processing routes... " process_routes Brakeman.notify "Processing templates... " process_templates Brakeman.notify "Processing data flow in templates..." process_template_data_flows Brakeman.notify "Processing models... " process_models Brakeman.notify "Processing controllers... " process_controllers Brakeman.notify "Processing data flow in controllers..." process_controller_data_flows Brakeman.notify "Indexing call sites... " index_call_sites tracker end |
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb
Stores parsed information in tracker.config
98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 |
# File 'lib/brakeman/scanner.rb', line 98 def process_config if [:rails3] process_config_file "application.rb" process_config_file "environments/production.rb" else process_config_file "environment.rb" process_config_file "gems.rb" end if @app_tree.exists?("vendor/plugins/rails_xss") or [:rails3] or [:escape_html] tracker.config[:escape_html] = true Brakeman.notify "[Notice] Escaping HTML by default" end end |
#process_controller(astfile) ⇒ Object
233 234 235 236 237 238 239 |
# File 'lib/brakeman/scanner.rb', line 233 def process_controller astfile begin @processor.process_controller(astfile.ast, astfile.path) rescue => e tracker.error e.exception(e. + "\nWhile processing #{astfile.path}"), e.backtrace end end |
#process_controller_data_flows ⇒ Object
219 220 221 222 223 224 225 226 227 228 229 230 231 |
# File 'lib/brakeman/scanner.rb', line 219 def process_controller_data_flows controllers = tracker.controllers.sort_by { |name, _| name.to_s } track_progress controllers, "controllers" do |name, controller| Brakeman.debug "Processing #{name}" controller[:src].each_value do |src| @processor.process_controller_alias name, src end end #No longer need these processed filter methods tracker.filter_cache.clear end |
#process_controllers ⇒ Object
Process all .rb files in controllers/
Adds processed controllers to tracker.controllers
212 213 214 215 216 217 |
# File 'lib/brakeman/scanner.rb', line 212 def process_controllers track_progress @file_list[:controllers] do |controller| Brakeman.debug "Processing #{controller.path}" process_controller controller end end |
#process_gems ⇒ Object
Process Gemfile
130 131 132 133 134 135 136 137 138 139 140 141 |
# File 'lib/brakeman/scanner.rb', line 130 def process_gems if @app_tree.exists? "Gemfile" if @app_tree.exists? "Gemfile.lock" @processor.process_gems(parse_ruby(@app_tree.read("Gemfile")), @app_tree.read("Gemfile.lock")) else @processor.process_gems(parse_ruby(@app_tree.read("Gemfile"))) end end rescue => e Brakeman.notify "[Notice] Error while processing Gemfile." tracker.error e.exception(e. + "\nWhile processing Gemfile"), e.backtrace end |
#process_initializer(init) ⇒ Object
Process an initializer
168 169 170 |
# File 'lib/brakeman/scanner.rb', line 168 def process_initializer init @processor.process_initializer(init.path, init.ast) end |
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/
Adds parsed information to tracker.initializers
160 161 162 163 164 165 |
# File 'lib/brakeman/scanner.rb', line 160 def process_initializers track_progress @file_list[:initializers] do |init| Brakeman.debug "Processing #{init[:path]}" process_initializer init end end |
#process_lib(lib) ⇒ Object
Process a library
188 189 190 |
# File 'lib/brakeman/scanner.rb', line 188 def process_lib lib @processor.process_lib lib.ast, lib.path end |
#process_libs ⇒ Object
Process all .rb in lib/
Adds parsed information to tracker.libs.
175 176 177 178 179 180 181 182 183 184 185 |
# File 'lib/brakeman/scanner.rb', line 175 def process_libs if [:skip_libs] Brakeman.notify '[Skipping]' return end track_progress @file_list[:libs] do |lib| Brakeman.debug "Processing #{lib.path}" process_lib lib end end |
#process_model(path, ast) ⇒ Object
276 277 278 |
# File 'lib/brakeman/scanner.rb', line 276 def process_model path, ast @processor.process_model(ast, path) end |
#process_models ⇒ Object
Process all the .rb files in models/
Adds the processed models to tracker.models
269 270 271 272 273 274 |
# File 'lib/brakeman/scanner.rb', line 269 def process_models track_progress @file_list[:models] do |model| Brakeman.debug "Processing #{model[:path]}" process_model model[:path], model[:ast] end end |
#process_routes ⇒ Object
Process config/routes.rb
Adds parsed information to tracker.routes
195 196 197 198 199 200 201 202 203 204 205 206 207 |
# File 'lib/brakeman/scanner.rb', line 195 def process_routes if @app_tree.exists?("config/routes.rb") begin @processor.process_routes parse_ruby(@app_tree.read("config/routes.rb")) rescue => e tracker.error e.exception(e. + "\nWhile processing routes.rb"), e.backtrace Brakeman.notify "[Notice] Error while processing routes - assuming all public controller methods are actions." [:assume_all_routes] = true end else Brakeman.notify "[Notice] No route information found" end end |
#process_template(template) ⇒ Object
253 254 255 |
# File 'lib/brakeman/scanner.rb', line 253 def process_template template @processor.process_template(template.name, template.ast, template.type, nil, template.path) end |
#process_template_data_flows ⇒ Object
257 258 259 260 261 262 263 264 |
# File 'lib/brakeman/scanner.rb', line 257 def process_template_data_flows templates = tracker.templates.sort_by { |name, _| name.to_s } track_progress templates, "templates" do |name, template| Brakeman.debug "Processing #{name}" @processor.process_template_alias template end end |
#process_templates ⇒ Object
Process all views and partials in views/
Adds processed views to tracker.views
244 245 246 247 248 249 250 251 |
# File 'lib/brakeman/scanner.rb', line 244 def process_templates templates = @file_list[:templates].sort_by { |t| t[:path] } track_progress templates, "templates" do |template| Brakeman.debug "Processing #{template[:path]}" process_template template end end |
#report_progress(current, total, type = "files") ⇒ Object
290 291 292 293 |
# File 'lib/brakeman/scanner.rb', line 290 def report_progress(current, total, type = "files") return unless @options[:report_progress] $stderr.print " #{current}/#{total} #{type} processed\r" end |
#track_progress(list, type = "files") ⇒ Object
280 281 282 283 284 285 286 287 288 |
# File 'lib/brakeman/scanner.rb', line 280 def track_progress list, type = "files" total = list.length current = 0 list.each do |item| report_progress current, total, type current += 1 yield item end end |
#tracker ⇒ Object
Returns the Tracker generated from the scan
35 36 37 |
# File 'lib/brakeman/scanner.rb', line 35 def tracker @processor.tracked_events end |