Class: Brakeman::AliasProcessor
- Inherits:
-
SexpProcessor
- Object
- SexpProcessor
- Brakeman::AliasProcessor
- Includes:
- ProcessorHelper, SafeCallHelper, Util
- Defined in:
- lib/brakeman/processors/alias_processor.rb
Overview
Returns an s-expression with aliases replaced with their value. This does not preserve semantics (due to side effects, etc.), but it makes processing easier when searching for various things.
Direct Known Subclasses
ConfigAliasProcessor, ControllerAliasProcessor, RouteAliasProcessor, TemplateAliasProcessor
Constant Summary collapse
- ARRAY_CONST =
s(:const, :Array)
- HASH_CONST =
s(:const, :Hash)
- RAILS_TEST =
s(:call, s(:call, s(:const, :Rails), :env), :test?)
Constants included from Util
Util::ALL_COOKIES, Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_COOKIES, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP
Constants inherited from SexpProcessor
Instance Attribute Summary collapse
-
#result ⇒ Object
readonly
Returns the value of attribute result.
-
#tracker ⇒ Object
readonly
Returns the value of attribute tracker.
Attributes inherited from SexpProcessor
Instance Method Summary collapse
- #array_detect_all_literals?(exp) ⇒ Boolean
-
#array_include_all_literals?(exp) ⇒ Boolean
Check if exp is a call to Array#include? on an array literal that contains all literal values.
- #assign_args(method_exp, args, meth_env = SexpProcessor::Environment.new) ⇒ Object
-
#collapse_send_call(exp, first_arg) ⇒ Object
Change x.send(:y, 1) to x.y(1).
- #duplicate?(exp) ⇒ Boolean
- #early_return?(exp) ⇒ Boolean
- #find_method(*args) ⇒ Object
-
#find_push_target(exp) ⇒ Object
Finds the inner most call target which is not the target of a call to <<.
- #get_call_value(call) ⇒ Object
-
#get_rhs(exp) ⇒ Object
Handles x = y = z = 1.
-
#initialize(tracker = nil, file_name = nil) ⇒ AliasProcessor
constructor
Returns a new AliasProcessor with an empty environment.
-
#join_arrays(array1, array2) ⇒ Object
Join two array literals into one.
-
#join_strings(string1, string2) ⇒ Object
Join two string literals into one.
- #merge_if_branch(branch_env) ⇒ Object
- #meth_env ⇒ Object
-
#only_ivars(include_request_vars = false, lenv = nil) ⇒ Object
Returns a new SexpProcessor::Environment containing only instance variables.
- #only_request_vars ⇒ Object
-
#process_array_access(target, args) ⇒ Object
Process single integer access to an array.
-
#process_attrasgn(exp) ⇒ Object
‘Attribute’ assignment x.y = 1 or x = 1.
-
#process_block(exp) ⇒ Object
Start new scope for block.
- #process_bracket_call(exp) ⇒ Object
-
#process_call(exp) ⇒ Object
Process a method call.
- #process_case(exp) ⇒ Object
-
#process_cdecl(exp) ⇒ Object
Constant assignments like BIG_CONSTANT = 234810983.
-
#process_cvdecl(exp) ⇒ Object
Class variable assignment @@x = 1.
-
#process_default(exp) ⇒ Object
Process a Sexp.
-
#process_defn(exp) ⇒ Object
Process a method definition.
-
#process_defs(exp) ⇒ Object
Process a method definition on self.
-
#process_gasgn(exp) ⇒ Object
Global assignment $x = 1.
-
#process_hash_access(target, index) ⇒ Object
Process hash access by returning the value associated with the given argument.
-
#process_hash_merge(hash, args) ⇒ Object
Return a new hash Sexp with the given values merged into it.
-
#process_hash_merge!(hash, args) ⇒ Object
Merge values into hash when processing.
- #process_helper_method(method_exp, args) ⇒ Object
-
#process_iasgn(exp) ⇒ Object
Instance variable assignment.
-
#process_if(exp) ⇒ Object
Sets @inside_if = true.
- #process_if_branch(exp) ⇒ Object
- #process_iter(exp) ⇒ Object
-
#process_lasgn(exp) ⇒ Object
Local assignment x = 1.
-
#process_masgn(exp) ⇒ Object
Multiple/parallel assignment:.
-
#process_op_asgn1(exp) ⇒ Object
Assignments like this x ||= 1.
-
#process_op_asgn2(exp) ⇒ Object
Assignments like this x.y ||= 1.
-
#process_or_simple_operation(exp) ⇒ Object
If possible, distribute operation over both sides of an or.
- #process_or_target(value, copy) ⇒ Object
-
#process_safely(src, set_env = nil, file_name = nil) ⇒ Object
This method processes the given Sexp, but copies it first so the original argument will not be modified.
-
#process_scope(exp) ⇒ Object
Process a new scope.
-
#process_svalue(exp) ⇒ Object
This is the right hand side value of a multiple assignment, like ‘x = y, z`.
- #raise?(exp) ⇒ Boolean
- #replace(exp, int = 0) ⇒ Object
-
#same_value?(lhs, rhs) ⇒ Boolean
Return true if lhs == rhs or lhs is an or expression and rhs is one of its values.
- #self_assign?(var, value) ⇒ Boolean
-
#self_assign_target?(var, value) ⇒ Boolean
Return true for x = x.blah.
-
#self_assign_var?(var, value) ⇒ Boolean
Return true if for x = blah or @x = blah.
-
#set_value(var, value) ⇒ Object
Set variable to given value.
- #simple_when?(exp) ⇒ Boolean
- #too_deep?(exp) ⇒ Boolean
-
#top_target(exp, last = nil) ⇒ Object
Returns last non-nil target in a call chain.
- #value_from_case(exp) ⇒ Object
- #value_from_if(exp) ⇒ Object
Methods included from Util
#array?, #block?, #call?, #camelize, #class_name, #constant?, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore
Methods included from ProcessorHelper
#current_file_name, #process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module
Methods inherited from SexpProcessor
#in_context, #process, processors, #scope
Constructor Details
#initialize(tracker = nil, file_name = nil) ⇒ AliasProcessor
Returns a new AliasProcessor with an empty environment.
The recommended usage is:
AliasProcessor.new.process_safely src
21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 |
# File 'lib/brakeman/processors/alias_processor.rb', line 21 def initialize tracker = nil, file_name = nil super() @env = SexpProcessor::Environment.new @inside_if = false @ignore_ifs = nil @exp_context = [] @current_module = nil @tracker = tracker #set in subclass as necessary @helper_method_cache = {} @helper_method_info = Hash.new({}) @or_depth_limit = (tracker && tracker.[:branch_limit]) || 5 #arbitrary default @meth_env = nil @file_name = file_name set_env_defaults end |
Instance Attribute Details
#result ⇒ Object (readonly)
Returns the value of attribute result.
14 15 16 |
# File 'lib/brakeman/processors/alias_processor.rb', line 14 def result @result end |
#tracker ⇒ Object (readonly)
Returns the value of attribute tracker.
14 15 16 |
# File 'lib/brakeman/processors/alias_processor.rb', line 14 def tracker @tracker end |
Instance Method Details
#array_detect_all_literals?(exp) ⇒ Boolean
635 636 637 638 639 640 641 642 |
# File 'lib/brakeman/processors/alias_processor.rb', line 635 def array_detect_all_literals? exp call? exp and [:detect, :find].include? exp.method and node_type? exp.target, :array and exp.target.length > 1 and exp.first_arg.nil? and exp.target.all? { |e| e.is_a? Symbol or node_type? e, :lit, :str } end |
#array_include_all_literals?(exp) ⇒ Boolean
Check if exp is a call to Array#include? on an array literal that contains all literal values. For example:
[1, 2, "a"].include? x
627 628 629 630 631 632 633 |
# File 'lib/brakeman/processors/alias_processor.rb', line 627 def array_include_all_literals? exp call? exp and exp.method == :include? and node_type? exp.target, :array and exp.target.length > 1 and exp.target.all? { |e| e.is_a? Symbol or node_type? e, :lit, :str } end |
#assign_args(method_exp, args, meth_env = SexpProcessor::Environment.new) ⇒ Object
1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1003 def assign_args method_exp, args, meth_env = SexpProcessor::Environment.new formal_args = method_exp.formal_args formal_args.each_with_index do |arg, index| next if index == 0 if arg.is_a? Symbol and sexp? args[index - 1] meth_env[Sexp.new(:lvar, arg)] = args[index - 1] end end meth_env end |
#collapse_send_call(exp, first_arg) ⇒ Object
Change x.send(:y, 1) to x.y(1)
866 867 868 869 870 871 872 873 874 875 876 877 878 879 |
# File 'lib/brakeman/processors/alias_processor.rb', line 866 def collapse_send_call exp, first_arg # Handle try(&:id) if node_type? first_arg, :block_pass first_arg = first_arg[1] end return unless symbol? first_arg or string? first_arg exp.method = first_arg.value.to_sym args = exp.args exp.pop # remove last arg if args.length > 1 exp.arglist = args[1..-1] end end |
#duplicate?(exp) ⇒ Boolean
1026 1027 1028 1029 1030 1031 1032 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1026 def duplicate? exp @exp_context[0..-2].reverse_each do |e| return true if exp == e end false end |
#early_return?(exp) ⇒ Boolean
707 708 709 710 711 712 713 714 715 716 717 |
# File 'lib/brakeman/processors/alias_processor.rb', line 707 def early_return? exp return true if node_type? exp, :return return true if call? exp and [:fail, :raise].include? exp.method if node_type? exp, :block, :rlist node_type? exp.last, :return or (call? exp and [:fail, :raise].include? exp.method) else false end end |
#find_method(*args) ⇒ Object
1034 1035 1036 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1034 def find_method *args nil end |
#find_push_target(exp) ⇒ Object
Finds the inner most call target which is not the target of a call to <<
1018 1019 1020 1021 1022 1023 1024 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1018 def find_push_target exp if call? exp and exp.method == :<< find_push_target exp.target else exp end end |
#get_call_value(call) ⇒ Object
918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 |
# File 'lib/brakeman/processors/alias_processor.rb', line 918 def get_call_value call method_name = call.method #Look for helper methods and see if we can get a return value if found_method = find_method(method_name, @current_class) helper = found_method[:method] if sexp? helper value = process_helper_method helper, call.args value.line(call.line) return value else raise "Unexpected value for method: #{found_method}" end else call end end |
#get_rhs(exp) ⇒ Object
Handles x = y = z = 1
388 389 390 391 392 393 394 |
# File 'lib/brakeman/processors/alias_processor.rb', line 388 def get_rhs exp if node_type? exp, :lasgn, :iasgn, :gasgn, :attrasgn, :safe_attrasgn, :cvdecl, :cdecl get_rhs(exp.rhs) else exp end end |
#join_arrays(array1, array2) ⇒ Object
Join two array literals into one.
847 848 849 850 851 |
# File 'lib/brakeman/processors/alias_processor.rb', line 847 def join_arrays array1, array2 result = Sexp.new(:array) result.concat array1[1..-1] result.concat array2[1..-1] end |
#join_strings(string1, string2) ⇒ Object
Join two string literals into one.
854 855 856 857 858 859 860 861 862 863 |
# File 'lib/brakeman/processors/alias_processor.rb', line 854 def join_strings string1, string2 result = Sexp.new(:str) result.value = string1.value + string2.value if result.value.length > 50 string1 else result end end |
#merge_if_branch(branch_env) ⇒ Object
798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 |
# File 'lib/brakeman/processors/alias_processor.rb', line 798 def merge_if_branch branch_env branch_env.each do |k, v| next if v.nil? current_val = env[k] if current_val unless same_value?(current_val, v) if too_deep? current_val # Give up branching, start over with latest value env[k] = v else env[k] = current_val.combine(v, k.line) end end else env[k] = v end end end |
#meth_env ⇒ Object
366 367 368 369 370 371 372 373 374 375 376 |
# File 'lib/brakeman/processors/alias_processor.rb', line 366 def meth_env begin env.scope do set_env_defaults @meth_env = env.current yield end ensure @meth_env = nil end end |
#only_ivars(include_request_vars = false, lenv = nil) ⇒ Object
Returns a new SexpProcessor::Environment containing only instance variables. This is useful, for example, when processing views.
883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 |
# File 'lib/brakeman/processors/alias_processor.rb', line 883 def only_ivars include_request_vars = false, lenv = nil lenv ||= env res = SexpProcessor::Environment.new if include_request_vars lenv.all.each do |k, v| #TODO Why would this have nil values? if (k.node_type == :ivar or request_value? k) and not v.nil? res[k] = v.dup end end else lenv.all.each do |k, v| #TODO Why would this have nil values? if k.node_type == :ivar and not v.nil? res[k] = v.dup end end end res end |
#only_request_vars ⇒ Object
906 907 908 909 910 911 912 913 914 915 916 |
# File 'lib/brakeman/processors/alias_processor.rb', line 906 def only_request_vars res = SexpProcessor::Environment.new env.all.each do |k, v| if request_value? k and not v.nil? res[k] = v.dup end end res end |
#process_array_access(target, args) ⇒ Object
Process single integer access to an array.
Returns the value inside the array, if possible.
829 830 831 832 833 834 835 836 837 838 |
# File 'lib/brakeman/processors/alias_processor.rb', line 829 def process_array_access target, args if args.length == 1 and integer? args.first index = args.first.value #Have to do this because first element is :array and we have to skip it target[1..-1][index] else nil end end |
#process_attrasgn(exp) ⇒ Object
‘Attribute’ assignment x.y = 1 or x = 1
464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 |
# File 'lib/brakeman/processors/alias_processor.rb', line 464 def process_attrasgn exp tar_variable = exp.target target = process(exp.target) method = exp.method index_arg = exp.first_arg value_arg = exp.second_arg if method == :[]= index = exp.first_arg = process(index_arg) value = exp.second_arg = process(value_arg) match = Sexp.new(:call, target, :[], index) set_value match, value if hash? target env[tar_variable] = hash_insert target.deep_clone, index, value end unless node_type? target, :hash exp.target = target end elsif method.to_s[-1,1] == "=" exp.first_arg = process(index_arg) value = get_rhs(exp) #This is what we'll replace with the value match = Sexp.new(:call, target, method.to_s[0..-2].to_sym) set_value match, value exp.target = target else raise "Unrecognized assignment: #{exp}" end exp end |
#process_block(exp) ⇒ Object
Start new scope for block.
352 353 354 355 356 |
# File 'lib/brakeman/processors/alias_processor.rb', line 352 def process_block exp env.scope do process_default exp end end |
#process_bracket_call(exp) ⇒ Object
90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 |
# File 'lib/brakeman/processors/alias_processor.rb', line 90 def process_bracket_call exp r = replace(exp) if r != exp return r end exp.arglist = process_default(exp.arglist) r = replace(exp) if r != exp return r end t = process(exp.target.deep_clone) # sometimes t[blah] has a match in the env # but we don't want to actually set the target # in case the target is big...which is what this # whole method is trying to avoid if t != exp.target e = exp.deep_clone e.target = t r = replace(e) if r != e return r end else t = nil end if hash? t if v = hash_access(t, exp.first_arg) v.deep_clone(exp.line) else case t.node_type when :params exp.target = PARAMS_SEXP.deep_clone(exp.target.line) when :session exp.target = SESSION_SEXP.deep_clone(exp.target.line) when :cookies exp.target = COOKIES_SEXP.deep_clone(exp.target.line) end exp end elsif array? t if v = process_array_access(t, exp.args) v.deep_clone(exp.line) else exp end elsif t exp.target = t exp else if exp.target # `self` target is reported as `nil` https://github.com/seattlerb/ruby_parser/issues/250 exp.target = process_default exp.target end exp end end |
#process_call(exp) ⇒ Object
Process a method call.
162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 |
# File 'lib/brakeman/processors/alias_processor.rb', line 162 def process_call exp return exp if process_call_defn? exp target_var = exp.target target_var &&= target_var.deep_clone if exp.node_type == :safe_call exp.node_type = :call end if exp.method == :[] return process_bracket_call exp else exp = process_default exp end #In case it is replaced with something else unless call? exp return exp end target = exp.target method = exp.method first_arg = exp.first_arg if method == :send or method == :try collapse_send_call exp, first_arg end if node_type? target, :or and [:+, :-, :*, :/].include? method res = process_or_simple_operation(exp) return res if res elsif target == ARRAY_CONST and method == :new return Sexp.new(:array, *exp.args) elsif target == HASH_CONST and method == :new and first_arg.nil? and !node_type?(@exp_context.last, :iter) return Sexp.new(:hash) elsif exp == RAILS_TEST return Sexp.new(:false) end #See if it is possible to simplify some basic cases #of addition/concatenation. case method when :+ if array? target and array? first_arg joined = join_arrays target, first_arg joined.line(exp.line) exp = joined elsif string? first_arg if string? target # "blah" + "blah" joined = join_strings target, first_arg joined.line(exp.line) exp = joined elsif call? target and target.method == :+ and string? target.first_arg joined = join_strings target.first_arg, first_arg joined.line(exp.line) target.first_arg = joined exp = target end elsif number? first_arg if number? target exp = Sexp.new(:lit, target.value + first_arg.value) elsif call? target and target.method == :+ and number? target.first_arg target.first_arg = Sexp.new(:lit, target.first_arg.value + first_arg.value) exp = target end end when :- if number? target and number? first_arg exp = Sexp.new(:lit, target.value - first_arg.value) end when :* if number? target and number? first_arg exp = Sexp.new(:lit, target.value * first_arg.value) end when :/ if number? target and number? first_arg if first_arg.value == 0 and not target.value.is_a? Float if @tracker location = [@current_class, @current_method, "line #{first_arg.line}"].compact.join(' ') require 'brakeman/processors/output_processor' code = Brakeman::OutputProcessor.new.format(exp) @tracker.error Exception.new("Potential divide by zero: #{code} (#{location})") end else exp = Sexp.new(:lit, target.value / first_arg.value) end end when :[] if array? target temp_exp = process_array_access target, exp.args exp = temp_exp if temp_exp elsif hash? target temp_exp = process_hash_access target, first_arg exp = temp_exp if temp_exp end when :merge!, :update if hash? target and hash? first_arg target = process_hash_merge! target, first_arg env[target_var] = target return target end when :merge if hash? target and hash? first_arg return process_hash_merge(target, first_arg) end when :<< if string? target and string? first_arg target.value << first_arg.value env[target_var] = target return target elsif string? target and string_interp? first_arg exp = Sexp.new(:dstr, target.value + first_arg[1]).concat(first_arg[2..-1]) env[target_var] = exp elsif string? first_arg and string_interp? target if string? target.last target.last.value << first_arg.value elsif target.last.is_a? String target.last << first_arg.value else target << first_arg end env[target_var] = target return first_arg elsif array? target target << first_arg env[target_var] = target return target else target = find_push_target(target_var) env[target] = exp unless target.nil? # Happens in TemplateAliasProcessor end when :first if array? target and first_arg.nil? and sexp? target[1] exp = target[1] end end exp end |
#process_case(exp) ⇒ Object
726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 |
# File 'lib/brakeman/processors/alias_processor.rb', line 726 def process_case exp if @ignore_ifs.nil? @ignore_ifs = @tracker && @tracker.[:ignore_ifs] end if @ignore_ifs process_default exp return exp end branch_scopes = [] was_inside = @inside_if @inside_if = true exp[1] = process exp[1] if exp[1] case_value = if node_type? exp[1], :lvar, :ivar, :call exp[1].deep_clone end exp.each_sexp do |e| if node_type? e, :when scope do @branch_env = env.current # set value of case var if possible if case_value and simple_when? e @branch_env[case_value] = e[1][1] end # when blocks aren't blocks, they are lists of expressions process_default e branch_scopes << env.current @branch_env = nil end end end # else clause if sexp? exp.last scope do @branch_env = env.current process_default exp[-1] branch_scopes << env.current @branch_env = nil end end @inside_if = was_inside branch_scopes.each do |s| merge_if_branch s end exp end |
#process_cdecl(exp) ⇒ Object
Constant assignments like BIG_CONSTANT = 234810983
597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 |
# File 'lib/brakeman/processors/alias_processor.rb', line 597 def process_cdecl exp if sexp? exp.rhs exp.rhs = process exp.rhs end if @tracker @tracker.add_constant exp.lhs, exp.rhs, :file => current_file_name, :module => @current_module, :class => @current_class, :method => @current_method end if exp.lhs.is_a? Symbol match = Sexp.new(:const, exp.lhs) else match = exp.lhs end env[match] = get_rhs(exp) exp end |
#process_cvdecl(exp) ⇒ Object
Class variable assignment @@x = 1
450 451 452 453 454 455 456 457 458 |
# File 'lib/brakeman/processors/alias_processor.rb', line 450 def process_cvdecl exp match = Sexp.new(:cvar, exp.lhs) exp.rhs = process(exp.rhs) value = get_rhs(exp) set_value match, value exp end |
#process_default(exp) ⇒ Object
Process a Sexp. If the Sexp has a value associated with it in the environment, that value will be returned.
55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 |
# File 'lib/brakeman/processors/alias_processor.rb', line 55 def process_default exp @exp_context.push exp begin exp.map! do |e| if sexp? e and not e.empty? process e else e end end rescue => err @tracker.error err if @tracker end result = replace(exp) @exp_context.pop result end |
#process_defn(exp) ⇒ Object
Process a method definition.
359 360 361 362 363 364 |
# File 'lib/brakeman/processors/alias_processor.rb', line 359 def process_defn exp meth_env do exp.body = process_all! exp.body end exp end |
#process_defs(exp) ⇒ Object
Process a method definition on self.
379 380 381 382 383 384 385 |
# File 'lib/brakeman/processors/alias_processor.rb', line 379 def process_defs exp env.scope do set_env_defaults exp.body = process_all! exp.body end exp end |
#process_gasgn(exp) ⇒ Object
Global assignment $x = 1
437 438 439 440 441 442 443 444 445 446 |
# File 'lib/brakeman/processors/alias_processor.rb', line 437 def process_gasgn exp match = Sexp.new(:gvar, exp.lhs) exp.rhs = process(exp.rhs) value = get_rhs(exp) value.line = exp.line set_value match, value exp end |
#process_hash_access(target, index) ⇒ Object
Process hash access by returning the value associated with the given argument.
842 843 844 |
# File 'lib/brakeman/processors/alias_processor.rb', line 842 def process_hash_access target, index hash_access(target, index) end |
#process_hash_merge(hash, args) ⇒ Object
Return a new hash Sexp with the given values merged into it.
args
should be a hash Sexp as well.
542 543 544 545 546 547 548 |
# File 'lib/brakeman/processors/alias_processor.rb', line 542 def process_hash_merge hash, args hash = hash.deep_clone hash_iterate args do |key, replacement| hash_insert hash, key, replacement end hash end |
#process_hash_merge!(hash, args) ⇒ Object
Merge values into hash when processing
h.merge! :something => “value”
529 530 531 532 533 534 535 536 537 |
# File 'lib/brakeman/processors/alias_processor.rb', line 529 def process_hash_merge! hash, args hash = hash.deep_clone hash_iterate args do |key, replacement| hash_insert hash, key, replacement match = Sexp.new(:call, hash, :[], key) env[match] = replacement end hash end |
#process_helper_method(method_exp, args) ⇒ Object
937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 |
# File 'lib/brakeman/processors/alias_processor.rb', line 937 def process_helper_method method_exp, args method_name = method_exp.method_name Brakeman.debug "Processing method #{method_name}" info = @helper_method_info[method_name] #If method uses instance variables, then include those and request #variables (params, etc) in the method environment. Otherwise, #only include request variables. if info[:uses_ivars] meth_env = only_ivars(:include_request_vars) else meth_env = only_request_vars end #Add arguments to method environment assign_args method_exp, args, meth_env #Find return values if method does not depend on environment/args values = @helper_method_cache[method_name] unless values #Serialize environment for cache key meth_values = meth_env.instance_variable_get(:@env).to_a meth_values.sort! meth_values = meth_values.to_s digest = Digest::SHA1.new.update(meth_values << method_name.to_s).to_s.to_sym values = @helper_method_cache[digest] end if values #Use values from cache values[:ivar_values].each do |var, val| env[var] = val end values[:return_value] else #Find return value for method frv = Brakeman::FindReturnValue.new value = frv.get_return_value(method_exp.body_list, meth_env) ivars = {} only_ivars(false, meth_env).all.each do |var, val| env[var] = val ivars[var] = val end if not frv.uses_ivars? and args.length == 0 #Store return value without ivars and args if they are not used @helper_method_cache[method_exp.method_name] = { :return_value => value, :ivar_values => ivars } else @helper_method_cache[digest] = { :return_value => value, :ivar_values => ivars } end #Store information about method, just ivar usage for now @helper_method_info[method_name] = { :uses_ivars => frv.uses_ivars? } value end end |
#process_iasgn(exp) ⇒ Object
Instance variable assignment
417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 |
# File 'lib/brakeman/processors/alias_processor.rb', line 417 def process_iasgn exp self_assign = self_assign?(exp.lhs, exp.rhs) exp.rhs = process exp.rhs ivar = Sexp.new(:ivar, exp.lhs).line(exp.line) if self_assign if env[ivar].nil? and @meth_env @meth_env[ivar] = get_rhs(exp) else env[ivar] = get_rhs(exp) end else set_value ivar, get_rhs(exp) end exp end |
#process_if(exp) ⇒ Object
Sets @inside_if = true
645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 |
# File 'lib/brakeman/processors/alias_processor.rb', line 645 def process_if exp if @ignore_ifs.nil? @ignore_ifs = @tracker && @tracker.[:ignore_ifs] end condition = exp.condition = process exp.condition #Check if a branch is obviously going to be taken if true? condition no_branch = true exps = [exp.then_clause, nil] elsif false? condition no_branch = true exps = [nil, exp.else_clause] else no_branch = false exps = [exp.then_clause, exp.else_clause] end if @ignore_ifs or no_branch exps.each_with_index do |branch, i| exp[2 + i] = process_if_branch branch end else was_inside = @inside_if @inside_if = true branch_scopes = [] exps.each_with_index do |branch, i| scope do @branch_env = env.current branch_index = 2 + i # s(:if, condition, then_branch, else_branch) if i == 0 and array_include_all_literals? condition # If the condition is ["a", "b"].include? x # set x to "a" inside the true branch var = condition.first_arg previous_value = env.current[var] env.current[var] = condition.target[1] exp[branch_index] = process_if_branch branch env.current[var] = previous_value elsif i == 1 and array_include_all_literals? condition and early_return? branch var = condition.first_arg env.current[var] = condition.target[1] exp[branch_index] = process_if_branch branch else exp[branch_index] = process_if_branch branch end branch_scopes << env.current @branch_env = nil end end @inside_if = was_inside branch_scopes.each do |s| merge_if_branch s end end exp end |
#process_if_branch(exp) ⇒ Object
788 789 790 791 792 793 794 795 796 |
# File 'lib/brakeman/processors/alias_processor.rb', line 788 def process_if_branch exp if sexp? exp if block? exp process_default exp else process exp end end end |
#process_iter(exp) ⇒ Object
302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 |
# File 'lib/brakeman/processors/alias_processor.rb', line 302 def process_iter exp @exp_context.push exp exp[1] = process exp.block_call if array_detect_all_literals? exp[1] return exp.block_call.target[1] end @exp_context.pop env.scope do exp.block_args.each do |e| #Force block arg(s) to be local if node_type? e, :lasgn env.current[Sexp.new(:lvar, e.lhs)] = Sexp.new(:lvar, e.lhs) elsif node_type? e, :kwarg env.current[Sexp.new(:lvar, e[1])] = e[2] elsif node_type? e, :masgn, :shadow e[1..-1].each do |var| local = Sexp.new(:lvar, var) env.current[local] = local end elsif e.is_a? Symbol local = Sexp.new(:lvar, e) env.current[local] = local else raise "Unexpected value in block args: #{e.inspect}" end end block = exp.block if block? block process_all! block else exp[3] = process block end end exp end |
#process_lasgn(exp) ⇒ Object
Local assignment x = 1
398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 |
# File 'lib/brakeman/processors/alias_processor.rb', line 398 def process_lasgn exp self_assign = self_assign?(exp.lhs, exp.rhs) exp.rhs = process exp.rhs if sexp? exp.rhs return exp if exp.rhs.nil? local = Sexp.new(:lvar, exp.lhs).line(exp.line || -2) if self_assign # Skip branching env[local] = get_rhs(exp) else set_value local, get_rhs(exp) end exp end |
#process_masgn(exp) ⇒ Object
Multiple/parallel assignment:
x, y = z, w
502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 |
# File 'lib/brakeman/processors/alias_processor.rb', line 502 def process_masgn exp unless array? exp[1] and array? exp[2] and exp[1].length == exp[2].length return process_default(exp) end vars = exp[1].dup vals = exp[2].dup vars.shift vals.shift # Call each assignment as if it is normal vars.each_with_index do |var, i| val = vals[i] if val assign = var.dup assign.rhs = val process assign end end exp end |
#process_op_asgn1(exp) ⇒ Object
Assignments like this x ||= 1
552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 |
# File 'lib/brakeman/processors/alias_processor.rb', line 552 def process_op_asgn1 exp return process_default(exp) if exp[3] != :"||" target = exp[1] = process(exp[1]) index = exp[2][1] = process(exp[2][1]) value = exp[4] = process(exp[4]) match = Sexp.new(:call, target, :[], index) unless env[match] if request_value? target env[match] = match.combine(value) else env[match] = value end end exp end |
#process_op_asgn2(exp) ⇒ Object
Assignments like this x.y ||= 1
573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 |
# File 'lib/brakeman/processors/alias_processor.rb', line 573 def process_op_asgn2 exp return process_default(exp) if exp[3] != :"||" target = exp[1] = process(exp[1]) value = exp[4] = process(exp[4]) method = exp[2] match = Sexp.new(:call, target, method.to_s[0..-2].to_sym) unless env[match] env[match] = value end exp end |
#process_or_simple_operation(exp) ⇒ Object
If possible, distribute operation over both sides of an or. For example,
(1 or 2) * 5
Becomes
(5 or 10)
Only works for strings and numbers right now.
1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1174 def process_or_simple_operation exp arg = exp.first_arg return nil unless string? arg or number? arg target = exp.target lhs = process_or_target(target.lhs, exp.dup) rhs = process_or_target(target.rhs, exp.dup) if lhs and rhs if same_value? lhs, rhs lhs else exp.target.lhs = lhs exp.target.rhs = rhs exp.target end else nil end end |
#process_or_target(value, copy) ⇒ Object
1195 1196 1197 1198 1199 1200 1201 1202 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1195 def process_or_target value, copy if string? value or number? value copy.target = value process copy else false end end |
#process_safely(src, set_env = nil, file_name = nil) ⇒ Object
This method processes the given Sexp, but copies it first so the original argument will not be modified.
set_env should be an instance of SexpProcessor::Environment. If provided, it will be used as the starting environment.
This method returns a new Sexp with variables replaced with their values, where possible.
45 46 47 48 49 50 51 |
# File 'lib/brakeman/processors/alias_processor.rb', line 45 def process_safely src, set_env = nil, file_name = nil @file_name = file_name @env = set_env || SexpProcessor::Environment.new @result = src.deep_clone process @result @result end |
#process_scope(exp) ⇒ Object
Process a new scope.
344 345 346 347 348 349 |
# File 'lib/brakeman/processors/alias_processor.rb', line 344 def process_scope exp env.scope do process exp.block end exp end |
#process_svalue(exp) ⇒ Object
This is the right hand side value of a multiple assignment, like ‘x = y, z`
591 592 593 |
# File 'lib/brakeman/processors/alias_processor.rb', line 591 def process_svalue exp exp.value end |
#raise?(exp) ⇒ Boolean
1132 1133 1134 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1132 def raise? exp call? exp and exp.method == :raise end |
#replace(exp, int = 0) ⇒ Object
77 78 79 80 81 82 83 84 85 86 87 88 |
# File 'lib/brakeman/processors/alias_processor.rb', line 77 def replace exp, int = 0 return exp if int > 3 if replacement = env[exp] and not duplicate? replacement replace(replacement.deep_clone(exp.line), int + 1) elsif tracker and replacement = tracker.constant_lookup(exp) and not duplicate? replacement replace(replacement.deep_clone(exp.line), int + 1) else exp end end |
#same_value?(lhs, rhs) ⇒ Boolean
Return true if lhs == rhs or lhs is an or expression and rhs is one of its values
1040 1041 1042 1043 1044 1045 1046 1047 1048 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1040 def same_value? lhs, rhs if lhs == rhs true elsif node_type? lhs, :or lhs.rhs == rhs or lhs.lhs == rhs else false end end |
#self_assign?(var, value) ⇒ Boolean
1050 1051 1052 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1050 def self_assign? var, value self_assign_var?(var, value) or self_assign_target?(var, value) end |
#self_assign_target?(var, value) ⇒ Boolean
Return true for x = x.blah
1063 1064 1065 1066 1067 1068 1069 1070 1071 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1063 def self_assign_target? var, value target = top_target(value) if node_type? target, :lvar, :ivar target = target.value end var == target end |
#self_assign_var?(var, value) ⇒ Boolean
Return true if for x = blah or @x = blah
1055 1056 1057 1058 1059 1060 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1055 def self_assign_var? var, value call? value and value.method == :+ and node_type? value.target, :lvar, :ivar and value.target.value == var end |
#set_value(var, value) ⇒ Object
Set variable to given value. Creates “branched” versions of values when appropriate. Avoids creating multiple branched versions inside same if branch.
1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1140 def set_value var, value if node_type? value, :if value = value_from_if(value) elsif node_type? value, :case value = value_from_case(value) end if @ignore_ifs or not @inside_if if @meth_env and node_type? var, :ivar and env[var].nil? @meth_env[var] = value else env[var] = value end elsif env.current[var] env.current[var] = value elsif @branch_env and @branch_env[var] @branch_env[var] = value elsif @branch_env and @meth_env and node_type? var, :ivar @branch_env[var] = value else env.current[var] = value end end |
#simple_when?(exp) ⇒ Boolean
719 720 721 722 723 724 |
# File 'lib/brakeman/processors/alias_processor.rb', line 719 def simple_when? exp node_type? exp[1], :array and not node_type? exp[1][1], :splat, :array and (exp[1].length == 2 or exp[1].all? { |e| e.is_a? Symbol or node_type? e, :lit, :str }) end |
#too_deep?(exp) ⇒ Boolean
819 820 821 822 823 824 |
# File 'lib/brakeman/processors/alias_processor.rb', line 819 def too_deep? exp @or_depth_limit >= 0 and node_type? exp, :or and exp.or_depth and exp.or_depth >= @or_depth_limit end |
#top_target(exp, last = nil) ⇒ Object
Returns last non-nil target in a call chain
1074 1075 1076 1077 1078 1079 1080 1081 1082 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1074 def top_target exp, last = nil if call? exp top_target exp.target, exp elsif node_type? exp, :iter top_target exp.block_call, last else exp || last end end |
#value_from_case(exp) ⇒ Object
1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1106 def value_from_case exp result = [] exp.each do |e| if node_type? e, :when result << e.last end end result << exp.last if exp.last # else result.reduce do |c, e| if c.nil? e elsif node_type? e, :if c.combine(value_from_if e) elsif raise? e c # ignore exceptions elsif e c.combine e else # when e is nil c end end end |
#value_from_if(exp) ⇒ Object
1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 |
# File 'lib/brakeman/processors/alias_processor.rb', line 1084 def value_from_if exp if block? exp.else_clause or block? exp.then_clause #If either clause is more than a single expression, just use entire #if expression for now exp elsif exp.else_clause.nil? exp.then_clause elsif exp.then_clause.nil? exp.else_clause else condition = exp.condition if true? condition exp.then_clause elsif false? condition exp.else_clause else exp.then_clause.combine(exp.else_clause, exp.line) end end end |