Class: Brakeman::SlimTemplateProcessor

Inherits:
TemplateProcessor show all
Includes:
RenderHelper
Defined in:
lib/brakeman/processors/slim_template_processor.rb

Constant Summary collapse

SAFE_BUFFER = 
s(:call, s(:colon2, s(:const, :ActiveSupport), :SafeBuffer), :new)
OUTPUT_BUFFER = 
s(:ivar, :@output_buffer)
TEMPLE_UTILS = 
s(:colon2, s(:colon3, :Temple), :Utils)
ATTR_MERGE = 
s(:call, s(:call, s(:array), :reject, s(:block_pass, s(:lit, :empty?))), :join, s(:str, " "))

Constants inherited from BaseProcessor

BaseProcessor::IGNORE

Constants included from Util

Util::ALL_COOKIES, Util::ALL_PARAMETERS, Util::COOKIES, Util::COOKIES_SEXP, Util::PARAMETERS, Util::PARAMS_SEXP, Util::PATH_PARAMETERS, Util::QUERY_PARAMETERS, Util::REQUEST_COOKIES, Util::REQUEST_ENV, Util::REQUEST_PARAMETERS, Util::REQUEST_PARAMS, Util::SESSION, Util::SESSION_SEXP

Constants inherited from SexpProcessor

Brakeman::SexpProcessor::VERSION

Instance Attribute Summary

Attributes inherited from SexpProcessor

#context, #env, #expected

Instance Method Summary collapse

Methods included from RenderHelper

#get_class_target, #get_options, #process_action, #process_layout, #process_partial, #process_template, #template_name

Methods inherited from TemplateProcessor

#add_output, #initialize, #normalize_output, #process, #process_escaped_output, #process_lasgn, #process_output

Methods inherited from BaseProcessor

#find_render_type, #ignore, #initialize, #make_inline_render, #make_render, #make_render_in_view, #process_arglist, #process_attrasgn, #process_block, #process_cdecl, #process_default, #process_dstr, #process_evstr, #process_file, #process_hash, #process_if, #process_ignore, #process_iter, #process_lasgn, #process_scope

Methods included from Util

#array?, #block?, #call?, #camelize, #class_name, #constant?, #contains_class?, #context_for, #cookies?, #false?, #file_by_name, #file_for, #github_url, #hash?, #hash_access, #hash_insert, #hash_iterate, #integer?, #make_call, #node_type?, #number?, #params?, #pluralize, #rails_version, #regexp?, #relative_path, #request_env?, #request_value?, #result?, #set_env_defaults, #sexp?, #string?, #string_interp?, #symbol?, #table_to_csv, #template_path_to_name, #true?, #truncate_table, #underscore

Methods included from ProcessorHelper

#current_file_name, #process_all, #process_all!, #process_call_args, #process_call_defn?, #process_class, #process_module

Methods inherited from SexpProcessor

#in_context, #initialize, #process, processors, #scope

Constructor Details

This class inherits a constructor from Brakeman::TemplateProcessor

Instance Method Details

#add_escaped_output(exp) ⇒ Object 



81
82
83
84
85
86
87
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 81

def add_escaped_output exp
  exp = normalize_output(exp)

  return exp if string? exp or internal_variable? exp

  super exp
end

#internal_variable?(exp) ⇒ Boolean

Returns:

  • (Boolean) 


95
96
97
98
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 95

def internal_variable? exp
  node_type? exp, :lvar and
  exp.value =~ /^_(temple_|slim_)/
end

#is_escaped?(exp) ⇒ Boolean

Returns:

  • (Boolean) 


89
90
91
92
93
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 89

def is_escaped? exp
  call? exp and
  exp.target == TEMPLE_UTILS and
  (exp.method == :escape_html or exp.method == :escape_html_safe)
end

#process_call(exp) ⇒ Object 



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 12

def process_call exp
  target = exp.target
  method = exp.method

  if method == :safe_concat and (target == SAFE_BUFFER or target == OUTPUT_BUFFER)
    arg = normalize_output(exp.first_arg)

    if is_escaped? arg
      add_escaped_output arg.first_arg
    elsif string? arg
      ignore
    elsif render? arg
      add_output make_render_in_view arg
    elsif string_interp? arg
      process_inside_interp arg
    elsif node_type? arg, :ignore
      ignore
    elsif internal_variable? arg
      ignore
    elsif arg == ATTR_MERGE
      ignore
    else
      add_output arg
    end
  elsif is_escaped? exp
    add_escaped_output arg
  elsif target == nil and method == :render
    exp.arglist = process exp.arglist
    make_render_in_view exp
  else
    exp.arglist = process exp.arglist
    exp
  end
end

#process_inside_interp(exp) ⇒ Object

Slim likes to interpolate output into strings then pass them to safe_concat. Better to pull those values out directly.



49
50
51
52
53
54
55
56
57
58
59
60
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 49

def process_inside_interp exp
  exp.map! do |e|
    if node_type? e, :evstr
      e.value = process_interp_output e.value
      e
    else
      e
    end
  end

  exp
end

#process_interp_output(exp) ⇒ Object 



62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 62

def process_interp_output exp
  if sexp? exp
    if node_type? exp, :if
      process_interp_output exp.then_clause
      process_interp_output exp.else_clause
    elsif exp == SAFE_BUFFER
      ignore
    elsif render? exp
      add_output make_render_in_view exp
    elsif node_type? :output, :escaped_output
      exp
    elsif is_escaped? exp
      add_escaped_output exp
    else
      add_output exp
    end
  end
end

#process_render(exp) ⇒ Object 



106
107
108
109
110
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 106

def process_render exp
  #Still confused as to why this is not needed in other template processors
  #but is needed here
  exp
end

#render?(exp) ⇒ Boolean

Returns:

  • (Boolean) 


100
101
102
103
104
 
# File 'lib/brakeman/processors/slim_template_processor.rb', line 100

def render? exp
  call? exp and
  exp.target.nil? and
  exp.method == :render
end