Class: Brakeman::Scanner
- Inherits:
-
Object
- Object
- Brakeman::Scanner
- Defined in:
- lib/brakeman/scanner.rb
Overview
Scans the Rails application.
Direct Known Subclasses
Instance Attribute Summary collapse
-
#options ⇒ Object
readonly
Returns the value of attribute options.
Instance Method Summary collapse
- #detect_file_types ⇒ Object
-
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile.
- #index_call_sites ⇒ Object
-
#initialize(options, processor = nil) ⇒ Scanner
constructor
Pass in path to the root of the Rails application.
- #parse_files ⇒ Object
- #parse_ruby_file(file) ⇒ Object
-
#process ⇒ Object
Process everything in the Rails application.
-
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb.
- #process_controller(astfile) ⇒ Object
- #process_controller_data_flows ⇒ Object
-
#process_controllers ⇒ Object
Process all .rb files in controllers/.
-
#process_gems ⇒ Object
Process Gemfile.
-
#process_initializer(init) ⇒ Object
Process an initializer.
-
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/.
-
#process_lib(lib) ⇒ Object
Process a library.
-
#process_libs ⇒ Object
Process all .rb in lib/.
- #process_model(path, ast) ⇒ Object
-
#process_models ⇒ Object
Process all the .rb files in models/.
-
#process_routes ⇒ Object
Process config/routes.rb.
- #process_template(template) ⇒ Object
- #process_template_data_flows ⇒ Object
-
#process_templates ⇒ Object
Process all views and partials in views/.
- #report_progress(current, total, type = "files") ⇒ Object
- #track_progress(list, type = "files") ⇒ Object
-
#tracker ⇒ Object
Returns the Tracker generated from the scan.
Constructor Details
#initialize(options, processor = nil) ⇒ Scanner
Pass in path to the root of the Rails application
22 23 24 25 26 27 28 29 30 31 32 33 34 |
# File 'lib/brakeman/scanner.rb', line 22 def initialize , processor = nil @options = @app_tree = Brakeman::AppTree.() if (!@app_tree.root || !@app_tree.exists?("app")) && ![:force_scan] = "Please supply the path to a Rails application (looking in #{@app_tree.root}).\n" << " Use `--force` to run a scan anyway." raise Brakeman::NoApplication, end @processor = processor || Brakeman::Processor.new(@app_tree, ) end |
Instance Attribute Details
#options ⇒ Object (readonly)
Returns the value of attribute options.
19 20 21 |
# File 'lib/brakeman/scanner.rb', line 19 def @options end |
Instance Method Details
#detect_file_types ⇒ Object
90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 |
# File 'lib/brakeman/scanner.rb', line 90 def detect_file_types @file_list = { controllers: [], initializers: [], libs: [], models: [], templates: [], } detector = Brakeman::FileTypeDetector.new @parsed_files.each do |file| if file.is_a? Brakeman::TemplateParser::TemplateFile @file_list[:templates] << file else type = detector.detect_type(file) unless type == :skip if @file_list[type].nil? raise type.to_s else @file_list[type] << file end end end end end |
#guess_rails_version ⇒ Object
Set :rails3/:rails4 option if version was not determined from Gemfile
195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 |
# File 'lib/brakeman/scanner.rb', line 195 def guess_rails_version unless tracker.[:rails3] or tracker.[:rails4] if @app_tree.exists?("script/rails") tracker.[:rails3] = true Brakeman.notify "[Notice] Detected Rails 3 application" elsif @app_tree.exists?("app/channels") tracker.[:rails3] = true tracker.[:rails4] = true tracker.[:rails5] = true Brakeman.notify "[Notice] Detected Rails 5 application" elsif not @app_tree.exists?("script") tracker.[:rails3] = true tracker.[:rails4] = true Brakeman.notify "[Notice] Detected Rails 4 application" end end end |
#index_call_sites ⇒ Object
351 352 353 |
# File 'lib/brakeman/scanner.rb', line 351 def index_call_sites tracker.index_call_sites end |
#parse_files ⇒ Object
73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 |
# File 'lib/brakeman/scanner.rb', line 73 def parse_files fp = Brakeman::FileParser.new(tracker.app_tree, tracker.[:parser_timeout], tracker.[:parallel_checks]) fp.parse_files tracker.app_tree.ruby_file_paths template_parser = Brakeman::TemplateParser.new(tracker, fp) fp.read_files(@app_tree.template_paths) do |path, contents| template_parser.parse_template path, contents end # Collect errors raised during parsing tracker.add_errors(fp.errors) @parsed_files = fp.file_list end |
#parse_ruby_file(file) ⇒ Object
355 356 357 358 359 360 361 |
# File 'lib/brakeman/scanner.rb', line 355 def parse_ruby_file file fp = Brakeman::FileParser.new(tracker.app_tree, tracker.[:parser_timeout]) fp.parse_ruby(file.read, file) rescue Exception => e tracker.error(e) nil end |
#process ⇒ Object
Process everything in the Rails application
42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 |
# File 'lib/brakeman/scanner.rb', line 42 def process Brakeman.notify "Processing gems... " process_gems guess_rails_version Brakeman.notify "Processing configuration... " process_config Brakeman.notify "Parsing files... " parse_files Brakeman.notify "Detecting file types... " detect_file_types Brakeman.notify "Processing initializers... " process_initializers Brakeman.notify "Processing libs... " process_libs Brakeman.notify "Processing routes... " process_routes Brakeman.notify "Processing templates... " process_templates Brakeman.notify "Processing data flow in templates... " process_template_data_flows Brakeman.notify "Processing models... " process_models Brakeman.notify "Processing controllers... " process_controllers Brakeman.notify "Processing data flow in controllers..." process_controller_data_flows Brakeman.notify "Indexing call sites... " index_call_sites tracker end |
#process_config ⇒ Object
Process config/environment.rb and config/gems.rb
Stores parsed information in tracker.config
120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 |
# File 'lib/brakeman/scanner.rb', line 120 def process_config # Sometimes folks like to put constants in environment.rb # so let's always process it even for newer Rails versions process_config_file "environment.rb" if [:rails3] or [:rails4] or [:rails5] or [:rails6] process_config_file "application.rb" process_config_file "environments/production.rb" else process_config_file "gems.rb" end if @app_tree.exists?("vendor/plugins/rails_xss") or [:rails3] or [:escape_html] tracker.config.escape_html = true Brakeman.notify "[Notice] Escaping HTML by default" end if @app_tree.exists? ".ruby-version" if version = @app_tree.file_path(".ruby-version").read[/(\d\.\d.\d+)/] tracker.config.set_ruby_version version end end tracker.config.load_rails_defaults end |
#process_controller(astfile) ⇒ Object
289 290 291 292 293 294 295 |
# File 'lib/brakeman/scanner.rb', line 289 def process_controller astfile begin @processor.process_controller(astfile.ast, astfile.path) rescue => e tracker.error e.exception(e. + "\nWhile processing #{astfile.path}"), e.backtrace end end |
#process_controller_data_flows ⇒ Object
275 276 277 278 279 280 281 282 283 284 285 286 287 |
# File 'lib/brakeman/scanner.rb', line 275 def process_controller_data_flows controllers = tracker.controllers.sort_by { |name, _| name.to_s } track_progress controllers, "controllers" do |name, controller| Brakeman.debug "Processing #{name}" controller.src.each do |file, src| @processor.process_controller_alias name, src, nil, file end end #No longer need these processed filter methods tracker.filter_cache.clear end |
#process_controllers ⇒ Object
Process all .rb files in controllers/
Adds processed controllers to tracker.controllers
268 269 270 271 272 273 |
# File 'lib/brakeman/scanner.rb', line 268 def process_controllers track_progress @file_list[:controllers] do |controller| Brakeman.debug "Processing #{controller.path}" process_controller controller end end |
#process_gems ⇒ Object
Process Gemfile
163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 |
# File 'lib/brakeman/scanner.rb', line 163 def process_gems gem_files = {} if @app_tree.exists? "Gemfile" file = @app_tree.file_path("Gemfile") gem_files[:gemfile] = { :src => parse_ruby_file(file), :file => file } elsif @app_tree.exists? "gems.rb" file = @app_tree.file_path("gems.rb") gem_files[:gemfile] = { :src => parse_ruby_file(file), :file => file } end if @app_tree.exists? "Gemfile.lock" file = @app_tree.file_path("Gemfile.lock") gem_files[:gemlock] = { :src => file.read, :file => file } elsif @app_tree.exists? "gems.locked" file = @app_tree.file_path("gems.locked") gem_files[:gemlock] = { :src => file.read, :file => file } end if @app_tree.gemspec gem_files[:gemspec] = { :src => parse_ruby_file(@app_tree.gemspec), :file => @app_tree.gemspec } end if not gem_files.empty? @processor.process_gems gem_files end rescue => e Brakeman.notify "[Notice] Error while processing Gemfile." tracker.error e.exception(e. + "\nWhile processing Gemfile"), e.backtrace end |
#process_initializer(init) ⇒ Object
Process an initializer
224 225 226 |
# File 'lib/brakeman/scanner.rb', line 224 def process_initializer init @processor.process_initializer(init.path, init.ast) end |
#process_initializers ⇒ Object
Process all the .rb files in config/initializers/
Adds parsed information to tracker.initializers
216 217 218 219 220 221 |
# File 'lib/brakeman/scanner.rb', line 216 def process_initializers track_progress @file_list[:initializers] do |init| Brakeman.debug "Processing #{init[:path]}" process_initializer init end end |
#process_lib(lib) ⇒ Object
Process a library
244 245 246 |
# File 'lib/brakeman/scanner.rb', line 244 def process_lib lib @processor.process_lib lib.ast, lib.path end |
#process_libs ⇒ Object
Process all .rb in lib/
Adds parsed information to tracker.libs.
231 232 233 234 235 236 237 238 239 240 241 |
# File 'lib/brakeman/scanner.rb', line 231 def process_libs if [:skip_libs] Brakeman.notify '[Skipping]' return end track_progress @file_list[:libs] do |lib| Brakeman.debug "Processing #{lib.path}" process_lib lib end end |
#process_model(path, ast) ⇒ Object
332 333 334 |
# File 'lib/brakeman/scanner.rb', line 332 def process_model path, ast @processor.process_model(ast, path) end |
#process_models ⇒ Object
Process all the .rb files in models/
Adds the processed models to tracker.models
325 326 327 328 329 330 |
# File 'lib/brakeman/scanner.rb', line 325 def process_models track_progress @file_list[:models] do |model| Brakeman.debug "Processing #{model[:path]}" process_model model[:path], model[:ast] end end |
#process_routes ⇒ Object
Process config/routes.rb
Adds parsed information to tracker.routes
251 252 253 254 255 256 257 258 259 260 261 262 263 |
# File 'lib/brakeman/scanner.rb', line 251 def process_routes if @app_tree.exists?("config/routes.rb") file = @app_tree.file_path("config/routes.rb") if routes_sexp = parse_ruby_file(file) @processor.process_routes routes_sexp else Brakeman.notify "[Notice] Error while processing routes - assuming all public controller methods are actions." [:assume_all_routes] = true end else Brakeman.notify "[Notice] No route information found" end end |
#process_template(template) ⇒ Object
309 310 311 |
# File 'lib/brakeman/scanner.rb', line 309 def process_template template @processor.process_template(template.name, template.ast, template.type, nil, template.path) end |
#process_template_data_flows ⇒ Object
313 314 315 316 317 318 319 320 |
# File 'lib/brakeman/scanner.rb', line 313 def process_template_data_flows templates = tracker.templates.sort_by { |name, _| name.to_s } track_progress templates, "templates" do |name, template| Brakeman.debug "Processing #{name}" @processor.process_template_alias template end end |
#process_templates ⇒ Object
Process all views and partials in views/
Adds processed views to tracker.views
300 301 302 303 304 305 306 307 |
# File 'lib/brakeman/scanner.rb', line 300 def process_templates templates = @file_list[:templates].sort_by { |t| t[:path] } track_progress templates, "templates" do |template| Brakeman.debug "Processing #{template[:path]}" process_template template end end |
#report_progress(current, total, type = "files") ⇒ Object
346 347 348 349 |
# File 'lib/brakeman/scanner.rb', line 346 def report_progress(current, total, type = "files") return unless @options[:report_progress] $stderr.print " #{current}/#{total} #{type} processed\r" end |
#track_progress(list, type = "files") ⇒ Object
336 337 338 339 340 341 342 343 344 |
# File 'lib/brakeman/scanner.rb', line 336 def track_progress list, type = "files" total = list.length current = 0 list.each do |item| report_progress current, total, type current += 1 yield item end end |
#tracker ⇒ Object
Returns the Tracker generated from the scan
37 38 39 |
# File 'lib/brakeman/scanner.rb', line 37 def tracker @processor.tracked_events end |