class Brakeman::TemplateAliasProcessor

Processes aliasing in templates. Handles calls to render.

Constants

COLLECTION_METHODS
FORM_BUILDER_CALL
FORM_METHODS
HAML_CAPTURE
UNKNOWN_MODEL_CALL

Public Class Methods

new(tracker, template, called_from = nil) click to toggle source
Calls superclass method Brakeman::AliasProcessor::new
# File lib/brakeman/processors/template_alias_processor.rb, line 14
def initialize tracker, template, called_from = nil
  super tracker
  @template = template
  @current_file = template.file
  @called_from = called_from
end

Public Instance Methods

find_push_target(exp) click to toggle source

Ignore `<<` calls on template variables which are used by the templating library (HAML, ERB, etc.)

# File lib/brakeman/processors/template_alias_processor.rb, line 135
def find_push_target exp
  if sexp? exp
    if exp.node_type == :lvar and (exp.value == :_buf or exp.value == :_erbout)
      return nil
    elsif exp.node_type == :ivar and exp.value == :@output_buffer
      return nil
    elsif exp.node_type == :call and call? exp.target and
      exp.target.method == :_hamlout and exp.method == :buffer

      return nil
    end
  end

  super
end
get_model_target(exp) click to toggle source

Checks if exp is a call to Model.all or Model.find*

# File lib/brakeman/processors/template_alias_processor.rb, line 117
def get_model_target exp
  if call? exp
    target = exp.target

    if COLLECTION_METHODS.include? exp.method or exp.method.to_s[0,4] == "find"
      models = Set.new @tracker.models.keys
      name = class_name target
      return target if models.include?(name)
    end

    return get_model_target(target)
  end

  false
end
haml_capture?(exp) click to toggle source
# File lib/brakeman/processors/template_alias_processor.rb, line 62
def haml_capture? exp
  node_type? exp, :iter and
    call? exp.block_call and
    HAML_CAPTURE.include? exp.block_call.method
end
process_iter(exp) click to toggle source

Looks for form methods and iterating over collections of Models

# File lib/brakeman/processors/template_alias_processor.rb, line 80
def process_iter exp
  process_default exp

  call = exp.block_call

  if call? call
    target = call.target
    method = call.method
    arg = exp.block_args.first_param
    block = exp.block

    #Check for e.g. Model.find.each do ... end
    if method == :each and arg and block and model = get_model_target(target)
      if arg.is_a? Symbol
        if model == target.target
          env[Sexp.new(:lvar, arg)] = Sexp.new(:call, model, :new)
        else
          env[Sexp.new(:lvar, arg)] = UNKNOWN_MODEL_CALL
        end

        process block if sexp? block
      end
    elsif FORM_METHODS.include? method
      if arg.is_a? Symbol
        env[Sexp.new(:lvar, arg)] = FORM_BUILDER_CALL

        process block if sexp? block
      end
    end
  end

  exp
end
process_lasgn(exp) click to toggle source
Calls superclass method Brakeman::AliasProcessor#process_lasgn
# File lib/brakeman/processors/template_alias_processor.rb, line 40
def process_lasgn exp
  if exp.lhs == :haml_temp or haml_capture? exp.rhs
    exp.rhs = process exp.rhs

    # Avoid propagating contents of block
    if node_type? exp.rhs, :iter
      new_exp = exp.dup
      new_exp.rhs = exp.rhs.block_call

      super new_exp

      exp # Still save the original, though
    else
      super exp
    end
  else
    super exp
  end
end
process_template(name, args, _, line = nil) click to toggle source

Process template

Calls superclass method Brakeman::RenderHelper#process_template
# File lib/brakeman/processors/template_alias_processor.rb, line 22
def process_template name, args, _, line = nil
  # Strip forward slash from beginning of template path.
  # This also happens in RenderHelper#process_template but
  # we need it here too to accurately avoid circular renders below.
  name = name.to_s.gsub(/^\//, "")

  if @called_from
    if @called_from.include_template? name
      Brakeman.debug "Skipping circular render from #{@template.name} to #{name}"
      return
    end

    super name, args, @called_from.dup.add_template_render(@template.name, line, @current_file), line
  else
    super name, args, Brakeman::RenderPath.new.add_template_render(@template.name, line, @current_file), line
  end
end
template_name(name) click to toggle source

Determine template name

# File lib/brakeman/processors/template_alias_processor.rb, line 69
def template_name name
  if !name.to_s.include?('/') && @template.name.to_s.include?('/')
    name = "#{@template.name.to_s.match(/^(.*\/).*$/)[1]}#{name}"
  end
  name
end