class Brakeman::TemplateAliasProcessor
Processes aliasing in templates. Handles calls to render
.
Constants
- COLLECTION_METHODS
- FORM_BUILDER_CALL
- FORM_METHODS
- HAML_CAPTURE
- UNKNOWN_MODEL_CALL
Public Class Methods
new(tracker, template, called_from = nil)
click to toggle source
Calls superclass method
Brakeman::AliasProcessor::new
# File lib/brakeman/processors/template_alias_processor.rb, line 14 def initialize tracker, template, called_from = nil super tracker @template = template @current_file = template.file @called_from = called_from end
Public Instance Methods
find_push_target(exp)
click to toggle source
Ignore `<<` calls on template variables which are used by the templating library (HAML, ERB, etc.)
Calls superclass method
Brakeman::AliasProcessor#find_push_target
# File lib/brakeman/processors/template_alias_processor.rb, line 135 def find_push_target exp if sexp? exp if exp.node_type == :lvar and (exp.value == :_buf or exp.value == :_erbout) return nil elsif exp.node_type == :ivar and exp.value == :@output_buffer return nil elsif exp.node_type == :call and call? exp.target and exp.target.method == :_hamlout and exp.method == :buffer return nil end end super end
get_model_target(exp)
click to toggle source
Checks if exp
is a call to Model.all or Model.find*
# File lib/brakeman/processors/template_alias_processor.rb, line 117 def get_model_target exp if call? exp target = exp.target if COLLECTION_METHODS.include? exp.method or exp.method.to_s[0,4] == "find" models = Set.new @tracker.models.keys name = class_name target return target if models.include?(name) end return get_model_target(target) end false end
haml_capture?(exp)
click to toggle source
# File lib/brakeman/processors/template_alias_processor.rb, line 62 def haml_capture? exp node_type? exp, :iter and call? exp.block_call and HAML_CAPTURE.include? exp.block_call.method end
process_iter(exp)
click to toggle source
Looks for form methods and iterating over collections of Models
# File lib/brakeman/processors/template_alias_processor.rb, line 80 def process_iter exp process_default exp call = exp.block_call if call? call target = call.target method = call.method arg = exp.block_args.first_param block = exp.block #Check for e.g. Model.find.each do ... end if method == :each and arg and block and model = get_model_target(target) if arg.is_a? Symbol if model == target.target env[Sexp.new(:lvar, arg)] = Sexp.new(:call, model, :new) else env[Sexp.new(:lvar, arg)] = UNKNOWN_MODEL_CALL end process block if sexp? block end elsif FORM_METHODS.include? method if arg.is_a? Symbol env[Sexp.new(:lvar, arg)] = FORM_BUILDER_CALL process block if sexp? block end end end exp end
process_lasgn(exp)
click to toggle source
Calls superclass method
Brakeman::AliasProcessor#process_lasgn
# File lib/brakeman/processors/template_alias_processor.rb, line 40 def process_lasgn exp if exp.lhs == :haml_temp or haml_capture? exp.rhs exp.rhs = process exp.rhs # Avoid propagating contents of block if node_type? exp.rhs, :iter new_exp = exp.dup new_exp.rhs = exp.rhs.block_call super new_exp exp # Still save the original, though else super exp end else super exp end end
process_template(name, args, _, line = nil)
click to toggle source
Process template
Calls superclass method
Brakeman::RenderHelper#process_template
# File lib/brakeman/processors/template_alias_processor.rb, line 22 def process_template name, args, _, line = nil # Strip forward slash from beginning of template path. # This also happens in RenderHelper#process_template but # we need it here too to accurately avoid circular renders below. name = name.to_s.gsub(/^\//, "") if @called_from if @called_from.include_template? name Brakeman.debug "Skipping circular render from #{@template.name} to #{name}" return end super name, args, @called_from.dup.add_template_render(@template.name, line, @current_file), line else super name, args, Brakeman::RenderPath.new.add_template_render(@template.name, line, @current_file), line end end
template_name(name)
click to toggle source
Determine template name
# File lib/brakeman/processors/template_alias_processor.rb, line 69 def template_name name if !name.to_s.include?('/') && @template.name.to_s.include?('/') name = "#{@template.name.to_s.match(/^(.*\/).*$/)[1]}#{name}" end name end