Class: Brakeman::Scanner
- Inherits:
-
Object
- Object
- Brakeman::Scanner
- Defined in:
- lib/brakeman/scanner.rb
Overview
Scans the Rails application.
Direct Known Subclasses
Constant Summary collapse
- RUBY_1_9 =
RUBY_VERSION >= "1.9.0"
Instance Attribute Summary collapse
-
#options ⇒ Object
readonly
Returns the value of attribute options.
Instance Method Summary collapse
-
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile.
- #index_call_sites ⇒ Object
-
#initialize(options, processor = nil) ⇒ Scanner
constructor
Pass in path to the root of the Rails application.
- #parse_files ⇒ Object
- #parse_ruby(input) ⇒ Object
-
#process ⇒ Object
Process everything in the Rails application.
-
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb.
- #process_controller(astfile) ⇒ Object
- #process_controller_data_flows ⇒ Object
-
#process_controllers ⇒ Object
Process all .rb files in controllers/.
-
#process_gems ⇒ Object
Process Gemfile.
-
#process_initializer(init) ⇒ Object
Process an initializer.
-
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/.
-
#process_lib(lib) ⇒ Object
Process a library.
-
#process_libs ⇒ Object
Process all .rb in lib/.
- #process_model(path, ast) ⇒ Object
-
#process_models ⇒ Object
Process all the .rb files in models/.
-
#process_routes ⇒ Object
Process config/routes.rb.
- #process_template(template) ⇒ Object
- #process_template_data_flows ⇒ Object
-
#process_templates ⇒ Object
Process all views and partials in views/.
- #report_progress(current, total, type = "files") ⇒ Object
- #track_progress(list, type = "files") ⇒ Object
-
#tracker ⇒ Object
Returns the Tracker generated from the scan.
Constructor Details
#initialize(options, processor = nil) ⇒ Scanner
Pass in path to the root of the Rails application
21 22 23 24 25 26 27 28 29 30 |
# File 'lib/brakeman/scanner.rb', line 21 def initialize , processor = nil @options = @app_tree = Brakeman::AppTree.() if (!@app_tree.root || !@app_tree.exists?("app")) && ![:force_scan] raise Brakeman::NoApplication, "Please supply the path to a Rails application (looking in #{@app_tree.root})." end @processor = processor || Brakeman::Processor.new(@app_tree, ) end |
Instance Attribute Details
#options ⇒ Object (readonly)
Returns the value of attribute options.
17 18 19 |
# File 'lib/brakeman/scanner.rb', line 17 def @options end |
Instance Method Details
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile
151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 |
# File 'lib/brakeman/scanner.rb', line 151 def guess_rails_version unless tracker.[:rails3] or tracker.[:rails4] if @app_tree.exists?("script/rails") tracker.[:rails3] = true Brakeman.notify "[Notice] Detected Rails 3 application" elsif @app_tree.exists?("app/channels") tracker.[:rails3] = true tracker.[:rails4] = true tracker.[:rails5] = true Brakeman.notify "[Notice] Detected Rails 5 application" elsif not @app_tree.exists?("script") tracker.[:rails3] = true tracker.[:rails4] = true Brakeman.notify "[Notice] Detected Rails 4 application" end end end |
#index_call_sites ⇒ Object
307 308 309 |
# File 'lib/brakeman/scanner.rb', line 307 def index_call_sites tracker.index_call_sites end |
#parse_files ⇒ Object
67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 |
# File 'lib/brakeman/scanner.rb', line 67 def parse_files fp = Brakeman::FileParser.new tracker, @app_tree files = { :initializers => @app_tree.initializer_paths, :controllers => @app_tree.controller_paths, :models => @app_tree.model_paths } unless [:skip_libs] files[:libs] = @app_tree.lib_paths end files.each do |name, paths| fp.parse_files paths, name end template_parser = Brakeman::TemplateParser.new(tracker, fp) fp.read_files(@app_tree.template_paths, :templates) do |path, contents| template_parser.parse_template path, contents end @file_list = fp.file_list end |
#parse_ruby(input) ⇒ Object
311 312 313 |
# File 'lib/brakeman/scanner.rb', line 311 def parse_ruby input RubyParser.new.parse input end |
#process ⇒ Object
Process everything in the Rails application
38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 |
# File 'lib/brakeman/scanner.rb', line 38 def process Brakeman.notify "Processing gems..." process_gems guess_rails_version Brakeman.notify "Processing configuration..." process_config Brakeman.notify "Parsing files..." parse_files Brakeman.notify "Processing initializers..." process_initializers Brakeman.notify "Processing libs..." process_libs Brakeman.notify "Processing routes... " process_routes Brakeman.notify "Processing templates... " process_templates Brakeman.notify "Processing data flow in templates..." process_template_data_flows Brakeman.notify "Processing models... " process_models Brakeman.notify "Processing controllers... " process_controllers Brakeman.notify "Processing data flow in controllers..." process_controller_data_flows Brakeman.notify "Indexing call sites... " index_call_sites tracker end |
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb
Stores parsed information in tracker.config
96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 |
# File 'lib/brakeman/scanner.rb', line 96 def process_config if [:rails3] or [:rails4] or [:rails5] process_config_file "application.rb" process_config_file "environments/production.rb" else process_config_file "environment.rb" process_config_file "gems.rb" end if @app_tree.exists?("vendor/plugins/rails_xss") or [:rails3] or [:escape_html] tracker.config.escape_html = true Brakeman.notify "[Notice] Escaping HTML by default" end end |
#process_controller(astfile) ⇒ Object
245 246 247 248 249 250 251 |
# File 'lib/brakeman/scanner.rb', line 245 def process_controller astfile begin @processor.process_controller(astfile.ast, astfile.path) rescue => e tracker.error e.exception(e. + "\nWhile processing #{astfile.path}"), e.backtrace end end |
#process_controller_data_flows ⇒ Object
231 232 233 234 235 236 237 238 239 240 241 242 243 |
# File 'lib/brakeman/scanner.rb', line 231 def process_controller_data_flows controllers = tracker.controllers.sort_by { |name, _| name.to_s } track_progress controllers, "controllers" do |name, controller| Brakeman.debug "Processing #{name}" controller.src.each do |file, src| @processor.process_controller_alias name, src, nil, file end end #No longer need these processed filter methods tracker.filter_cache.clear end |
#process_controllers ⇒ Object
Process all .rb files in controllers/
Adds processed controllers to tracker.controllers
224 225 226 227 228 229 |
# File 'lib/brakeman/scanner.rb', line 224 def process_controllers track_progress @file_list[:controllers] do |controller| Brakeman.debug "Processing #{controller.path}" process_controller controller end end |
#process_gems ⇒ Object
Process Gemfile
128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 |
# File 'lib/brakeman/scanner.rb', line 128 def process_gems gem_files = {} if @app_tree.exists? "Gemfile" gem_files[:gemfile] = { :src => parse_ruby(@app_tree.read("Gemfile")), :file => "Gemfile" } elsif @app_tree.exists? "gems.rb" gem_files[:gemfile] = { :src => parse_ruby(@app_tree.read("gems.rb")), :file => "gems.rb" } end if @app_tree.exists? "Gemfile.lock" gem_files[:gemlock] = { :src => @app_tree.read("Gemfile.lock"), :file => "Gemfile.lock" } elsif @app_tree.exists? "gems.locked" gem_files[:gemlock] = { :src => @app_tree.read("gems.locked"), :file => "gems.locked" } end if gem_files[:gemfile] or gem_files[:gemlock] @processor.process_gems gem_files end rescue => e Brakeman.notify "[Notice] Error while processing Gemfile." tracker.error e.exception(e. + "\nWhile processing Gemfile"), e.backtrace end |
#process_initializer(init) ⇒ Object
Process an initializer
180 181 182 |
# File 'lib/brakeman/scanner.rb', line 180 def process_initializer init @processor.process_initializer(init.path, init.ast) end |
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/
Adds parsed information to tracker.initializers
172 173 174 175 176 177 |
# File 'lib/brakeman/scanner.rb', line 172 def process_initializers track_progress @file_list[:initializers] do |init| Brakeman.debug "Processing #{init[:path]}" process_initializer init end end |
#process_lib(lib) ⇒ Object
Process a library
200 201 202 |
# File 'lib/brakeman/scanner.rb', line 200 def process_lib lib @processor.process_lib lib.ast, lib.path end |
#process_libs ⇒ Object
Process all .rb in lib/
Adds parsed information to tracker.libs.
187 188 189 190 191 192 193 194 195 196 197 |
# File 'lib/brakeman/scanner.rb', line 187 def process_libs if [:skip_libs] Brakeman.notify '[Skipping]' return end track_progress @file_list[:libs] do |lib| Brakeman.debug "Processing #{lib.path}" process_lib lib end end |
#process_model(path, ast) ⇒ Object
288 289 290 |
# File 'lib/brakeman/scanner.rb', line 288 def process_model path, ast @processor.process_model(ast, path) end |
#process_models ⇒ Object
Process all the .rb files in models/
Adds the processed models to tracker.models
281 282 283 284 285 286 |
# File 'lib/brakeman/scanner.rb', line 281 def process_models track_progress @file_list[:models] do |model| Brakeman.debug "Processing #{model[:path]}" process_model model[:path], model[:ast] end end |
#process_routes ⇒ Object
Process config/routes.rb
Adds parsed information to tracker.routes
207 208 209 210 211 212 213 214 215 216 217 218 219 |
# File 'lib/brakeman/scanner.rb', line 207 def process_routes if @app_tree.exists?("config/routes.rb") begin @processor.process_routes parse_ruby(@app_tree.read("config/routes.rb")) rescue => e tracker.error e.exception(e. + "\nWhile processing routes.rb"), e.backtrace Brakeman.notify "[Notice] Error while processing routes - assuming all public controller methods are actions." [:assume_all_routes] = true end else Brakeman.notify "[Notice] No route information found" end end |
#process_template(template) ⇒ Object
265 266 267 |
# File 'lib/brakeman/scanner.rb', line 265 def process_template template @processor.process_template(template.name, template.ast, template.type, nil, template.path) end |
#process_template_data_flows ⇒ Object
269 270 271 272 273 274 275 276 |
# File 'lib/brakeman/scanner.rb', line 269 def process_template_data_flows templates = tracker.templates.sort_by { |name, _| name.to_s } track_progress templates, "templates" do |name, template| Brakeman.debug "Processing #{name}" @processor.process_template_alias template end end |
#process_templates ⇒ Object
Process all views and partials in views/
Adds processed views to tracker.views
256 257 258 259 260 261 262 263 |
# File 'lib/brakeman/scanner.rb', line 256 def process_templates templates = @file_list[:templates].sort_by { |t| t[:path] } track_progress templates, "templates" do |template| Brakeman.debug "Processing #{template[:path]}" process_template template end end |
#report_progress(current, total, type = "files") ⇒ Object
302 303 304 305 |
# File 'lib/brakeman/scanner.rb', line 302 def report_progress(current, total, type = "files") return unless @options[:report_progress] $stderr.print " #{current}/#{total} #{type} processed\r" end |
#track_progress(list, type = "files") ⇒ Object
292 293 294 295 296 297 298 299 300 |
# File 'lib/brakeman/scanner.rb', line 292 def track_progress list, type = "files" total = list.length current = 0 list.each do |item| report_progress current, total, type current += 1 yield item end end |
#tracker ⇒ Object
Returns the Tracker generated from the scan
33 34 35 |
# File 'lib/brakeman/scanner.rb', line 33 def tracker @processor.tracked_events end |