Upgrading brakeman 4 to 5
Breaking4.10.1 → 5.4.1Breaking1Security1Platform3New30Changed23Fixed31Other3
BreakingUpgrade verdict
1 breaking change and 3 platform requirement changes and a security fix.
In plain terms
- The CSV report now outputs a simple list of warnings, so anything parsing the old CSV layout may need updating.
- Brakeman can now parse code written for Ruby 3.1.
- You need at least Ruby 2.5.0 to run this version of Brakeman.
- Brakeman now requires Ruby 2.4.0 or newer.
Must act 5 items need code or config changes
Ruby requirement changed in 5.2.0: >= 2.3.0 → >= 2.5.0.
What you must change
Breaking1
Revamps the CSV report into a CSV list of warnings, changing the report format.
Security1
Adds a check for CVE-2022-32209.
Platform3
Updates
ruby_parser for Ruby 3.1 support.ruby_parserRequires Ruby 2.5.0 or newer.
Updates the required Ruby version to 2.4.0.
API changes
Generated by DepDelta from published Ruby source. Not mixed with prose notes.
- added:
class String - added:
property String.lineno: accessor
- removed:
method CallConversionHelper.all_literals?(_, _ = …) - removed:
method ControllerAliasProcessor.find_method(_, _) - removed:
method Util.request_env?(_) - changed:
constructor FileParser(_) → constructor FileParser(_, _, _ = …) - changed:
method Collection.get_method(_) → method Collection.get_method(_, _ = …) - changed:
method Config.set_ruby_version(_) → method Config.set_ruby_version(_, _, _) - changed:
method FileParser.parse_files(_, _) → method FileParser.parse_files(_) - changed:
method FileParser.read_files(_, _) → method FileParser.read_files(_) - added:
class CheckEOLRails < Brakeman::EOLCheck - added:
class CheckEOLRuby < Brakeman::EOLCheck - added:
class CheckPathname < Brakeman::BaseCheck - added:
class CheckSanitizeConfigCve < Brakeman::BaseCheck - added:
class CheckUnsafeReflectionMethods < Brakeman::BaseCheck - added:
class CheckVerbConfusion < Brakeman::BaseCheck - added:
class CheckWeakRSAKey < Brakeman::BaseCheck - added:
class EOLCheck < Brakeman::BaseCheck - added:
class FileTypeDetector < BaseProcessor - added:
class MethodInfo - added:
const AliasProcessor.RAILS_DEV - added:
const AliasProcessor.TEMP_FILE_CLASS - added:
const AppTree.EXCLUDED_PATHS - added:
const BaseCheck.I18N_CLASS - added:
const BaseCheck.TEMP_FILE_PATH - added:
const CheckEOLRails.RAILS_EOL_DATES - added:
const CheckEOLRuby.RUBY_EOL_DATES - added:
const CheckSQL.DATE_CLASS - added:
const CheckWeakRSAKey.NO_PADDING - added:
const CheckWeakRSAKey.NO_PADDING_STR - added:
const CheckWeakRSAKey.PKCS1_PADDING - added:
const CheckWeakRSAKey.PKCS1_PADDING_STR - added:
const CheckWeakRSAKey.SSLV23_PADDING - added:
const CheckWeakRSAKey.SSLV23_PADDING_STR - added:
const FileTypeDetector.MODEL_CLASSES - added:
const HamlTemplateProcessor.ATTRIBUTE_BUILDER - added:
const Rails4ConfigProcessor.ALT_APPLICATION_CONFIG - added:
const Util.SIMPLE_LITERALS - added:
constructor FileTypeDetector() - added:
constructor MethodInfo(_, _, _, _) - added:
method AliasProcessor.all_literals_when?(_) - added:
method AliasProcessor.equality_check?(_) - added:
method AliasProcessor.hash_include_all_literals?(_) - added:
method AliasProcessor.hash_or_array_include_all_literals?(_) - added:
method AliasProcessor.in_array_all_literals?(_) - added:
method AliasProcessor.process_branch_with_value(_, _, _, _) - added:
method AliasProcessor.splat_array?(_) - added:
method AliasProcessor.temp_file_new(_) - added:
method AliasProcessor.temp_file_open?(_) - added:
method AppTree.ruby_file_paths() - added:
method CallConversionHelper.hash_values_at(_, _) - added:
method CheckEOLRails.run_check() - added:
method CheckEOLRuby.run_check() - added:
method CheckPathname.check_pathname_join() - added:
method CheckPathname.check_rails_root_join() - added:
method CheckPathname.check_result(_) - added:
method CheckPathname.run_check() - added:
method CheckRedirect.allow_other_host?(_) - added:
method CheckRedirect.disallow_other_host?(_) - added:
method CheckRedirect.protected_by_raise?(_) - added:
method CheckRedirect.raise_on_redirects?() - added:
method CheckRender.known_renderable_class?(_) - added:
method CheckRender.renderable?(_) - added:
method CheckSQL.date_target?(_) - added:
method CheckSQL.ignore_call?(_) - added:
method CheckSQL.ignore_methods_in_sql() - added:
method CheckSQL.number_target?(_) - added:
method CheckSanitizeConfigCve.check_config() - added:
method CheckSanitizeConfigCve.check_safe_list_allowed_tags() - added:
method CheckSanitizeConfigCve.check_sanitize_calls() - added:
method CheckSanitizeConfigCve.cve_warning(confidence: …, result: …) - added:
method CheckSanitizeConfigCve.run_check() - added:
method CheckUnsafeReflectionMethods.check_method() - added:
method CheckUnsafeReflectionMethods.check_tap() - added:
method CheckUnsafeReflectionMethods.check_to_proc() - added:
method CheckUnsafeReflectionMethods.run_check() - added:
method CheckUnsafeReflectionMethods.warn_unsafe_reflection(_, _) - added:
method CheckVerbConfusion.process_if(_) - added:
method CheckVerbConfusion.process_result(_) - added:
method CheckVerbConfusion.run_check() - added:
method CheckVerbConfusion.warn_about_result(_, _) - added:
method CheckWeakRSAKey.check_key_size(_, _) - added:
method CheckWeakRSAKey.check_padding(_, _) - added:
method CheckWeakRSAKey.check_rsa_key_creation() - added:
method CheckWeakRSAKey.check_rsa_operations() - added:
method CheckWeakRSAKey.run_check() - added:
method Collection.get_class_method(_) - added:
method Collection.get_instance_method(_) - added:
method Collection.get_simple_method_return_value(_, _) - added:
method Config.load_rails_defaults() - added:
method Config.set_rails_config(value:, path:, overwrite: …) - added:
method EOLCheck.check_eol_version(_, _) - added:
method EOLCheck.warn_about_soon_unsupported_version(_, _, _, _) - added:
method EOLCheck.warn_about_unsupported_version(_, _, _) - added:
method FileTypeDetector.detect_type(_) - added:
method FileTypeDetector.guess_from_path(_) - added:
method FileTypeDetector.process_class(_) - added:
method HamlTemplateProcessor.haml_attribute_builder?(_) - added:
method MethodInfo.[](_) - added:
method MethodInfo.first_body() - added:
method MethodInfo.return_value(_ = …) - added:
method MethodInfo.very_simple_method?() - added:
method ModelProcessor.add_enum_method(_) - added:
method Rails3ConfigProcessor.process_call(_) - added:
method Report.to_sonar() - added:
method Scanner.detect_file_types() - added:
method TemplateParser.load_slim_smart?() - added:
method Tracker.add_errors(_) - added:
method Tracker.find_method(_, _, _ = …) - added:
method Util.all_literals?(_, _ = …) - added:
method Util.hash_values(_) - added:
method Util.recurse_check?(_) - added:
method Util.request_headers?(_) - added:
method Util.simple_literal?(_) - added:
property FileParser.errors: reader - added:
property MethodInfo.file: reader - added:
property MethodInfo.name: reader - added:
property MethodInfo.owner: reader - added:
property MethodInfo.src: reader - added:
property MethodInfo.type: reader - added:
property Warning.cwe_id: reader
- changed:
class IGNORE < Sexp.new → class IGNORE < Sexp.new(:ignore)
- removed:
const Base.TEXT_CONFIDENCE - removed:
method CSV.csv_header() - removed:
method CSV.table_to_csv(_) - changed:
class CSV < Brakeman::Report::Table → class CSV < Brakeman::Report::Base - added:
class Github < Brakeman::Report::Base - added:
class Sonar < Brakeman::Report::Base - added:
method CSV.generate_row(_, _) - added:
method CSV.warning_row(_) - added:
method Github.errors() - added:
method Github.generate_report() - added:
method Github.warnings() - added:
method Sonar.generate_report()