Changes since 3.6.1:
- Remove
--rakeoption - By default, do not honor additional check paths in config
- Properly handle template names without
.htmlor.js - Catch YAML parsing errors in session settings check (#1046)
- Better handling of
ifexpressions in HAML rendering (#1032) - Avoid warning about SQLi with
to_sinexists?(#1045) - Handle safe call operator in checks (#1031)
- Handle empty
ifexpressions when finding return values - Set template file names during rendering for better errors
- Limit Slim dependency to before 3.0.8
- Update RubyParser to 3.9.0
Rake Option Removed
The Rake task generated by --rake has caused quite a few problems. When Rake is run with a Rails application, it loads all of the app’s dependencies, which may conflict with Brakeman’s dependencies.
It is recommended to either not use a Rake task to run Brakeman or just shell out to Brakeman instead of using it as a library.
(changes)
Check Paths in Config Files
Brakeman allows loading custom checks with --add-checks-path.
To avoid silently loading arbitary code, Brakeman will not support this option in configuration files unless explicitly enabled with --allow-check-paths-in-config.
(changes)
Templates without Format Extension
The 3.5.0 release added support for templates with a bare extension (like my_template.haml) but template names derived internally did not handle these bare extensions properly. When rendering templates, Brakeman was not able to match render names to the correct files.
(changes)
YAML Errors
When checking session settings, Brakeman parses config/secrets.yml. Sometimes this file has unsafe values or interpolated code which causes the parsing to fail. Brakeman will now only output a notice about this failure instead of an error.
(changes)
If Expressions in HAML
Typically Brakeman assumes all if branches in templates are taken and ignores the condition. This was not happening in all cases in rendered HAML templates.
(changes)
to_s False Positive with exists?
Brakeman will no longer warn about arguments calling to_s in exists?, since that is the recommended way to avoid SQL injection with that particular method.
(changes)
Better Safe Call Handling
The safe call operation &. will be handled better in all checks instead of being ignored.
(changes)
Empty Ifs
This release fixes an issue when finding return values from methods ending in an empty if expression.
(changes)
More Template Names
Template file names will now be set when passing code to template rendering libraries, in order to produce better error messages when something goes wrong.
(changes)
Dependencies
RubyParser has been updated to 3.9.0 which resolves some issues.
(changes)
Slim is limited to <3.0.8 since the 3.0.8 gem requires Ruby 2.0.
(changes)
Checksums
The SHA256 sums for this release are:
Reporting Issues
Thank you to everyone who reported bugs and contributed to this release!
Please report any issues with this release. Take a look at this guide to reporting Brakeman problems.
Hang out on GitHub for questions and discussion.