Upgrading brakeman 3 to 4
Breaking3.7.2 → 4.10.1Breaking8Security19New33Changed16Fixed41Other74
BreakingUpgrade verdict
8 breaking changes and 19 security fixes.
In plain terms
- Remove whitelist/blacklist language, add clarifications.
- Remove version guard for named_scope vs. scope.
- Remove code for Ruby versions prior to 1.9.
- Remove Sass dependency.
Must act Top 5 of 27 that need code or config changes
Ruby requirement changed in 4.5.0: >= 0 → >= 2.3.0.
What you must change
Breaking8
Remove whitelist/blacklist language, add clarifications.
Remove version guard for named_scope vs. scope.
named_scopescopeRemove code for Ruby versions prior to 1.9.
Remove Sass dependency.
Remove check for use of permit with *_id keys.
permit*_idRemove errors about divide by zero.
Remove low confidence mass assignment warnings.
Remove reliance on CONFIDENCE constant in checks.
CONFIDENCESecurity19
Check chomped strings for SQL injection.
chompAdd check for CVE-2020-8166 (Jamie Finnigan).
Add check for CVE-2020-8159.
Find SQL injection in String#strip_heredoc target.
String#strip_heredocIgnore form_for for XSS check.
form_forAdd SQL injection checks for destroy_by/delete_by.
destroy_bydelete_byAdd SQL injection checks for find_or_create_by and friends.
find_or_create_byCheck link_to with block for href XSS.
link_toImprove "user input" reported for SQL injection.
Add check for CVE-2018-3760.
Avoid warning about command injection when String#shellescape and Shellwords.shelljoin are used (George Ogata).
String#shellescapeShellwords.shelljoinAdd warning for CVE-2018-3741.
Add warning for CVE-2018-8048.
Warn about SQL injection with not.
notAvoid warning about command injection with Shellwords.escape.
Shellwords.escapeAvoid CSRF warning in Rails 5.2 default config.
Fix upgrade version for CVE-2016-6316.
Reduce warnings about XSS in link_to.
link_toRename "Cross Site Scripting" to "Cross-Site Scripting" (Paul Tetreau).
API changes
Generated by DepDelta from published Ruby source. Not mixed with prose notes.
- changed:
static method Brakeman.check_for_missing_checks(_, _) → static method Brakeman.check_for_missing_checks(_, _, _) - added:
const Brakeman.Empty_Ignore_Note_Exit_Code - added:
const Sexp.CALLS - added:
method Brakeman.each() - added:
method Brakeman.include_any_method?(_) - added:
method Brakeman.include_controller?(_) - added:
method Brakeman.include_template?(_) - added:
method Brakeman.join(*) - added:
method Brakeman.last() - added:
method Brakeman.length() - added:
method Brakeman.map() - added:
method Brakeman.rendered_from_controller?() - added:
method Brakeman.to_a() - added:
method Brakeman.to_json(*) - added:
method Brakeman.to_s() - added:
method Brakeman.to_sym() - added:
method Brakeman.with_relative_paths() - added:
module Slim - added:
static method Brakeman.ignore_file_entries_with_empty_notes(_)
- removed:
const CheckSQL.STRING_METHODS - removed:
const Constants.LITERALS - removed:
const Differ.DEFAULT_HASH - removed:
const Differ.OLD_WARNING_KEYS - removed:
const HamlTemplateProcessor.HAML_FORMAT_METHOD - removed:
const Scanner.RUBY_1_9 - removed:
method AliasProcessor.join_arrays(_, _) - removed:
method AliasProcessor.join_strings(_, _) - removed:
method AliasProcessor.process_array_access(_, _) - removed:
method AliasProcessor.process_hash_access(_, _) - removed:
method AppTree.path_exists?(_) - removed:
method AppTree.read(_) - removed:
method AppTree.read_path(_) - removed:
method CheckExecute.check_for_backticks(_) - removed:
method CheckExecute.check_open_calls() - removed:
method CheckExecute.dangerous?(_) - removed:
method CheckExecute.dangerous_interp?(_) - removed:
method CheckExecute.dangerous_open_arg?(_) - removed:
method CheckExecute.process_backticks(_) - removed:
method CheckExecute.process_result(_) - removed:
method CheckSQL.string_building?(_) - removed:
method Config.allow_forgery_protection?() - removed:
method Constants.get_literal(_) - removed:
method Constants.literal?(_) - removed:
method Differ.eql_except_line_number(_, _) - removed:
method FileParser.read_path(_) - removed:
method FindAllCalls.process_attrasgn(_) - removed:
method FindAllCalls.process_dregx(_) - removed:
method FindAllCalls.process_dsym(_) - removed:
method FindCall.process_rlist(_) - removed:
method HamlTemplateProcessor.is_buffer_target?(_) - removed:
method ProcessorHelper.current_file_name() - removed:
method RenderPath.each() - removed:
method RenderPath.include_any_method?(_) - removed:
method RenderPath.include_controller?(_) - removed:
method RenderPath.include_template?(_) - removed:
method RenderPath.join(*) - removed:
method RenderPath.last() - removed:
method RenderPath.length() - removed:
method RenderPath.rendered_from_controller?() - removed:
method RenderPath.to_a() - removed:
method RenderPath.to_json(*) - removed:
method RenderPath.to_s() - removed:
method RenderPath.to_sym() - removed:
method Scanner.parse_ruby(_) - removed:
method Util.context_for(_, _, _ = …) - removed:
method Util.file_by_name(_, _, _ = …) - removed:
method Util.file_for(_, _ = …) - removed:
method Util.github_url(_, _ = …) - removed:
method Util.relative_path(_) - removed:
method Util.table_to_csv(_) - removed:
method Util.truncate_table(_) - removed:
method Warning.fingerprint() - removed:
method Warning.format_code(_ = …) - removed:
method Warning.format_message() - removed:
method Warning.format_user_input(_ = …) - removed:
method Warning.format_with_user_input(_ = …) - removed:
method Warning.link() - removed:
method Warning.location(_ = …) - removed:
method Warning.to_hash() - removed:
method Warning.to_json() - removed:
method Warning.to_row(_ = …) - removed:
method Warning.to_s() - removed:
method Warning.view_name(_ = …) - removed:
property Config.rails_version: accessor - removed:
property Warning.relative_path: accessor - changed:
constructor BaseCheck(_, _) → constructor BaseCheck(_) - changed:
constructor ControllerAliasProcessor(_, _, _ = …) → constructor ControllerAliasProcessor(_, _ = …) - changed:
constructor ControllerProcessor(_, _) → constructor ControllerProcessor(_, _ = …) - changed:
constructor FileParser(_, _) → constructor FileParser(_) - changed:
constructor FindCall(_, _, _, _ = …) → constructor FindCall(_, _, _) - changed:
constructor Report(_, _) → constructor Report(_) - changed:
method BaseCheck.add_result(_, _ = …) → method BaseCheck.add_result(_) - changed:
method CheckNestedAttributesBypass.warn_about_nested_attributes(_, _, _) → method CheckNestedAttributesBypass.warn_about_nested_attributes(_, _) - changed:
method CheckSQL.ar_scope_calls(_ = …) → method CheckSQL.ar_scope_calls(_) - changed:
method CheckSanitizeMethods.warn_sanitizer_cve(_, _) → method CheckSanitizeMethods.warn_sanitizer_cve(_, _, _) - changed:
method Config.set_rails_version() → method Config.set_rails_version(_ = …) - changed:
method FindCall.process_source(_, _ = …, _ = …, _ = …) → method FindCall.process_source(_) - changed:
method TemplateAliasProcessor.process_template(_, _, _, _ = …, _ = …) → method TemplateAliasProcessor.process_template(_, _, _, _ = …) - changed:
property Config.ruby_version: accessor → property Config.ruby_version: reader - changed:
static method Checks.actually_run_checks(_, _, _, _) → static method Checks.actually_run_checks(_, _, _) - changed:
static method Checks.missing_checks(_, _) → static method Checks.missing_checks(_) - changed:
static method Checks.run_checks(_, _) → static method Checks.run_checks(_) - added:
class CheckCSRFTokenForgeryCVE < Brakeman::BaseCheck - added:
class CheckCookieSerialization < Brakeman::BaseCheck - added:
class CheckDivideByZero < Brakeman::BaseCheck - added:
class CheckForceSSL < Brakeman::BaseCheck - added:
class CheckJSONEntityEscape < Brakeman::BaseCheck - added:
class CheckPageCachingCVE < Brakeman::BaseCheck - added:
class CheckPermitAttributes < Brakeman::BaseCheck - added:
class CheckReverseTabnabbing < Brakeman::BaseCheck - added:
class CheckSprocketsPathTraversal < Brakeman::BaseCheck - added:
class CheckTemplateInjection < Brakeman::BaseCheck - added:
class FilePath - added:
class Pager - added:
class Rails4ConfigProcessor < Brakeman::Rails3ConfigProcessor - added:
const AliasProcessor.STRING_NEW - added:
const CallConversionHelper.STRING_LENGTH_LIMIT - added:
const CheckExecute.KNOWN_SHELL_COMMANDS - added:
const CheckExecute.SHELLWORDS - added:
const CheckExecute.SHELL_ESCAPE_MIXIN_METHODS - added:
const CheckExecute.SHELL_ESCAPE_MODULE_METHODS - added:
const CheckLinkToHref.CHECK_INSIDE_METHODS - added:
const CheckPermitAttributes.SUSPICIOUS_KEYS - added:
const CheckRedirect.DANGEROUS_KEYS - added:
const CheckSQL.TO_STRING_METHODS - added:
const GemProcessor.GEM_SPEC - added:
const HamlTemplateProcessor.ESCAPE_METHODS - added:
const HamlTemplateProcessor.HAMLOUT - added:
const HamlTemplateProcessor.HAML_BUFFER - added:
const HamlTemplateProcessor.HAML_HELPERS2 - added:
const HamlTemplateProcessor.PRESERVE_METHODS - added:
const Rails4ConfigProcessor.APPLICATION_CONFIG - added:
const SlimTemplateProcessor.EMBEDDED_FILTER - added:
const TemplateAliasProcessor.HAML_CAPTURE - added:
const Util.ALL_COOKIES - added:
const Util.DIR_CONST - added:
const Util.LITERALS - added:
const Util.REQUEST_COOKIES - added:
const Util.SAFE_LITERAL - added:
const Warning.CONFIDENCE - added:
constructor CheckCrossSiteScripting(*) - added:
constructor CheckDefaultRoutes(*) - added:
constructor CheckJSONParsing(*) - added:
constructor CheckSimpleFormat(*) - added:
constructor FilePath(_, _) - added:
constructor HamlTemplateProcessor(*) - added:
constructor OutputProcessor(*) - added:
constructor Pager(_, _ = …, _ = …) - added:
method AliasProcessor.join_item(_, _) - added:
method AliasProcessor.new_string?(_) - added:
method AliasProcessor.process_array_join(_, _) - added:
method AliasProcessor.process_hash(_) - added:
method AppTree.file_path(_) - added:
method AppTree.gemspec() - added:
method AppTree.relative_path(_) - added:
method BaseCheck.process_array(_) - added:
method BaseProcessor.process_rlist(_) - added:
method CallConversionHelper.all_literals?(_, _ = …) - added:
method CallConversionHelper.join_arrays(_, _, _ = …) - added:
method CallConversionHelper.join_strings(_, _, _ = …) - added:
method CallConversionHelper.math_op(_, _, _, _ = …) - added:
method CallConversionHelper.process_array_access(_, _, _ = …) - added:
method CallConversionHelper.process_hash_access(_, _, _ = …) - added:
method CallIndex.remove_indexes_by_file(_) - added:
method CheckCSRFTokenForgeryCVE.run_check() - added:
method CheckCookieSerialization.run_check() - added:
method CheckDeserialize.check_oj() - added:
method CheckDivideByZero.check_division(_) - added:
method CheckDivideByZero.run_check() - added:
method CheckFileAccess.called_on_tempfile?(_) - added:
method CheckFileAccess.sanitized?(_) - added:
method CheckFileAccess.temp_file_method?(_) - added:
method CheckForceSSL.run_check() - added:
method CheckJSONEntityEscape.check_config_setting() - added:
method CheckJSONEntityEscape.check_manual_disable() - added:
method CheckJSONEntityEscape.run_check() - added:
method CheckLinkToHref.check_argument?(_) - added:
method CheckLinkToHref.ignore_model_call?(_, _) - added:
method CheckMassAssignment.calls_slice?(_) - added:
method CheckMassAssignment.check_permit_all_parameters() - added:
method CheckMassAssignment.inside_safe_method?(_) - added:
method CheckPageCachingCVE.run_check() - added:
method CheckPageCachingCVE.uses_caches_page?() - added:
method CheckPermitAttributes.check_permit(_) - added:
method CheckPermitAttributes.run_check() - added:
method CheckPermitAttributes.warn_on_permit_key(_, _, _ = …) - added:
method CheckRedirect.safe_permit?(_) - added:
method CheckReverseTabnabbing.process_result(_) - added:
method CheckReverseTabnabbing.run_check() - added:
method CheckSanitizeMethods.check_cve_2018_8048() - added:
method CheckSanitizeMethods.check_rails_html_sanitizer() - added:
method CheckSanitizeMethods.loofah_vulnerable_cve_2018_8048?() - added:
method CheckSprocketsPathTraversal.has_workaround?() - added:
method CheckSprocketsPathTraversal.run_check() - added:
method CheckSymbolDoS.symbolizing_attributes?(_) - added:
method CheckTemplateInjection.process_result(_) - added:
method CheckTemplateInjection.run_check() - added:
method CheckUnscopedFind.optional_belongs_to?(_) - added:
method Config.default_protect_from_forgery?() - added:
method Config.escape_filter_interpolations?() - added:
method Config.extract_version(_) - added:
method Config.rails_version() - added:
method Config.version_between?(_, _, _ = …) - added:
method Constants.get_simple_value(_) - added:
method Differ.fingerprint(_) - added:
method FakeHamlFilter.compile(_, _) - added:
method FilePath.<=>(_) - added:
method FilePath.==(_) - added:
method FilePath.basename() - added:
method FilePath.eql?(_) - added:
method FilePath.exists?() - added:
method FilePath.hash() - added:
method FilePath.read() - added:
method FilePath.to_s() - added:
method FilePath.to_str() - added:
method FindAllCalls.process_all_source(_, _) - added:
method GemProcessor.process_iter(_) - added:
method HamlTemplateProcessor.buffer_append?(_) - added:
method HamlTemplateProcessor.find_and_preserve?(_) - added:
method HamlTemplateProcessor.fix_textareas?(_) - added:
method HamlTemplateProcessor.haml_helpers?(_) - added:
method HamlTemplateProcessor.hamlout_attributes?(_) - added:
method HamlTemplateProcessor.raw?(_) - added:
method IgnoreConfig.already_ignored_entries_with_empty_notes() - added:
method Messages.msg(*) - added:
method Messages.msg_code(_) - added:
method Messages.msg_cve(_) - added:
method Messages.msg_file(_) - added:
method Messages.msg_input(_) - added:
method Messages.msg_lit(_) - added:
method Messages.msg_plain(_) - added:
method Messages.msg_version(_, _ = …) - added:
method Pager.in_ci?() - added:
method Pager.less_available?() - added:
method Pager.less_options() - added:
method Pager.no_pager(_) - added:
method Pager.page_output(_) - added:
method Pager.page_report(_, _) - added:
method Pager.page_via_highline(_) - added:
method Pager.page_via_less(_) - added:
method Pager.set_color() - added:
method ProcessorHelper.current_file() - added:
method Rails4ConfigProcessor.process_iter(_) - added:
method RenderPath.last_template() - added:
method Report.to_sarif() - added:
method Report.to_table() - added:
method Report.to_text() - added:
method Scanner.parse_ruby_file(_) - added:
method SlimTemplateProcessor.embedded_filter?(_) - added:
method SlimTemplateProcessor.normalize_output(_) - added:
method TemplateAliasProcessor.haml_capture?(_) - added:
method TemplateAliasProcessor.process_lasgn(_) - added:
method Tracker.reset_initializer(_) - added:
method Util.dir_glob?(_) - added:
method Util.kwsplat?(_) - added:
method Util.literal?(_) - added:
method Util.remove_kwsplat(_) - added:
method Util.safe_literal(_ = …) - added:
method Util.safe_literal?(_) - added:
method Util.safe_literal_target?(_) - added:
method Warning.confidence() - added:
module CallConversionHelper - added:
module Codeclimate - added:
module FakeHamlFilter - added:
module Messages - added:
property FilePath.absolute: reader - added:
property FilePath.relative: reader - added:
property Tracker.app_tree: accessor - added:
static method FilePath.from_app_tree(_, _)
- added:
class EngineConfiguration - added:
constructor EngineConfiguration(_ = …) - added:
method EngineConfiguration.options()
- added:
class CVE - added:
class Code - added:
class FileName - added:
class Input - added:
class Literal - added:
class Message - added:
class Plain - added:
class Version - added:
constructor CVE(_) - added:
constructor Code(_) - added:
constructor FileName(_) - added:
constructor Input(_) - added:
constructor Literal(_) - added:
constructor Message(*) - added:
constructor Plain(_) - added:
constructor Version(_, _) - added:
method CVE.to_html() - added:
method CVE.to_s() - added:
method Code.to_html() - added:
method Code.to_s() - added:
method FileName.to_html() - added:
method FileName.to_s() - added:
method Input.friendly_type_of(_) - added:
method Input.to_html() - added:
method Input.to_s() - added:
method Literal.to_html() - added:
method Literal.to_s() - added:
method Message.<<(_) - added:
method Message.to_html() - added:
method Message.to_s() - added:
method Plain.to_html() - added:
method Plain.to_s() - added:
method Version.to_html() - added:
method Version.to_s()
- removed:
method Base.convert_controller_warning(_, _) - removed:
method Base.convert_ignored_warning(_, _) - removed:
method Base.convert_model_warning(_, _) - removed:
method Base.convert_template_warning(_, _) - removed:
method Base.convert_to_rows(_, _ = …) - removed:
method Base.convert_warning(_, _) - removed:
method Base.generate_controller_warnings() - removed:
method Base.generate_controllers() - removed:
method Base.generate_errors() - removed:
method Base.generate_ignored_warnings() - removed:
method Base.generate_model_warnings() - removed:
method Base.generate_obsolete() - removed:
method Base.generate_template_warnings() - removed:
method Base.generate_warning_overview() - removed:
method Base.generate_warnings() - removed:
method Base.render_warnings(_, _, _, _, _) - removed:
method Base.sort(_, _) - removed:
method Base.text_message(_, _) - changed:
class HTML < Brakeman::Report::Base → class HTML < Brakeman::Report::Table - changed:
class Tabs < Brakeman::Report::Base → class Tabs < Brakeman::Report::Table - changed:
constructor Base(_, _) → constructor Base(_) - changed:
method Base.warning_file(_, _ = …) → method Base.warning_file(_) - added:
class JUnit < Brakeman::Report::Base - added:
class SARIF < Brakeman::Report::Base - added:
method Base.absolute_paths?() - added:
method Base.context_for(_) - added:
method Base.controller_information() - added:
method Base.github_url(_, _ = …) - added:
method CSV.table_to_csv(_) - added:
method JUnit.generate_report() - added:
method SARIF.check_descriptions() - added:
method SARIF.generate_report() - added:
method SARIF.infer_level(_) - added:
method SARIF.render_id(_) - added:
method SARIF.render_message(_) - added:
method SARIF.results() - added:
method SARIF.rules() - added:
method SARIF.runs() - added:
method SARIF.unique_warnings_by_warning_code() - added:
method Table.convert_ignored_warning(_, _) - added:
method Table.convert_template_warning(_, _) - added:
method Table.convert_to_rows(_, _ = …) - added:
method Table.convert_warning(_, _) - added:
method Table.generate_controller_warnings() - added:
method Table.generate_controllers() - added:
method Table.generate_errors() - added:
method Table.generate_ignored_warnings() - added:
method Table.generate_model_warnings() - added:
method Table.generate_obsolete() - added:
method Table.generate_template_warnings() - added:
method Table.generate_warning_overview() - added:
method Table.generate_warnings() - added:
method Table.render_warnings(_, _, _, _, _) - added:
method Table.sort(_, _) - added:
method Table.text_message(_, _) - added:
method Table.truncate_table(_) - added:
method Text.format_line(_, _) - added:
method Text.generate_controllers()
- changed:
class REQUEST_PARAMETERS < Sexp.new(:call, Sexp.new(:call, nil, :request), :request_parameters) → class REQUEST_PARAMETERS < Sexp.new(:call, Sexp.new(:call, nil, :request), :parameters) - changed:
class REQUEST_PARAMS < Sexp.new(:call, Sexp.new(:call, nil, :request), :parameters) → class REQUEST_PARAMS < Sexp.new(:call, Sexp.new(:call, nil, :request), :params) - added:
class REQUEST_REQUEST_PARAMETERS < Sexp.new(:call, Sexp.new(:call, nil, :request), :request_parameters)
- added:
module Coffee - added:
module Markdown - added:
module Sass
- added:
class Embedded
- added:
class CoffeeEngine < TiltEngine - added:
class SassEngine - added:
class TiltEngine - added:
method TiltEngine.on_slim_embedded(_, _, _) - added:
protected method CoffeeEngine.tilt_render(_, _, _) - added:
protected method SassEngine.tilt_render(_, _, _)