Class: Brakeman::ErubisTemplateProcessor
- Inherits:
-
TemplateProcessor
- Object
- SexpProcessor
- BaseProcessor
- TemplateProcessor
- Brakeman::ErubisTemplateProcessor
- Defined in:
- lib/brakeman/processors/erubis_template_processor.rb
Overview
Processes ERB templates using Erubis instead of erb.
Constant Summary
Constants inherited from BaseProcessor
Constants included from Util
Util::ALL_COOKIES, Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_COOKIES, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP
Constants inherited from SexpProcessor
Instance Attribute Summary
Attributes inherited from SexpProcessor
Instance Method Summary collapse
-
#process_attrasgn(exp) ⇒ Object
Look for assignments to output buffer that look like this: @output_buffer.append = some_output @output_buffer.safe_append = some_output @output_buffer.safe_expr_append = some_output.
-
#process_block(exp) ⇒ Object
Process blocks, ignoring :ignore exps.
-
#process_call(exp) ⇒ Object
s(:call, TARGET, :method, ARGS).
Methods inherited from TemplateProcessor
#add_escaped_output, #add_output, #initialize, #normalize_output, #process, #process_escaped_output, #process_lasgn, #process_output
Methods inherited from BaseProcessor
#find_render_type, #ignore, #initialize, #make_inline_render, #make_render, #make_render_in_view, #process_arglist, #process_cdecl, #process_default, #process_dstr, #process_evstr, #process_file, #process_hash, #process_if, #process_ignore, #process_iter, #process_lasgn, #process_scope
Methods included from Util
#array?, #block?, #call?, #camelize, #class_name, #constant?, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore
Methods included from ProcessorHelper
#current_file_name, #process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module
Methods inherited from SexpProcessor
#in_context, #initialize, #process, processors, #scope
Constructor Details
This class inherits a constructor from Brakeman::TemplateProcessor
Instance Method Details
#process_attrasgn(exp) ⇒ Object
Look for assignments to output buffer that look like this:
@output_buffer.append = some_output
@output_buffer.safe_append = some_output
@output_buffer.safe_expr_append = some_output
63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 |
# File 'lib/brakeman/processors/erubis_template_processor.rb', line 63 def process_attrasgn exp if exp.target.node_type == :ivar and exp.target.value == :@output_buffer if append_method?(exp.method) exp.first_arg = process(exp.first_arg) arg = normalize_output(exp.first_arg) if arg.node_type == :str ignore elsif safe_append_method?(exp.method) add_output arg else add_escaped_output arg end else super end else super end end |
#process_block(exp) ⇒ Object
Process blocks, ignoring :ignore exps
43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 |
# File 'lib/brakeman/processors/erubis_template_processor.rb', line 43 def process_block exp exp = exp.dup exp.shift exp.map! do |e| res = process e if res.empty? or res == ignore nil else res end end block = Sexp.new(:rlist).concat(exp).compact block.line(exp.line) block end |
#process_call(exp) ⇒ Object
s(:call, TARGET, :method, ARGS)
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 |
# File 'lib/brakeman/processors/erubis_template_processor.rb', line 7 def process_call exp target = exp.target if sexp? target target = process target end exp.target = target exp.arglist = process exp.arglist method = exp.method #_buf is the default output variable for Erubis if node_type?(target, :lvar, :ivar) and (target.value == :_buf or target.value == :@output_buffer) if method == :<< or method == :safe_concat arg = normalize_output(exp.first_arg) if arg.node_type == :str #ignore plain strings ignore elsif node_type? target, :ivar and target.value == :@output_buffer add_escaped_output arg else add_output arg end elsif method == :to_s ignore else abort "Unrecognized action on buffer: #{method}" end elsif target == nil and method == :render make_render_in_view exp else exp end end |