Brakeman 4.3.0 Released

Did you know we recently broke 11 million gem downloads? Wow!

--color Option

Previously, --no-color could be used to turn off ANSI color in text reports. Now, --color can be used to force color output.

(changes)

--parser-timeout Option

The default timeout for parsing a single file is 10 seconds. For some files, this may not be enough.

The --parser-timeout option can be used to specify a per-file timeout (in seconds).

Additionally, the error message for parsing timeouts has been improved considerably.

(changes)

Command Injection Fixes

Thanks to Jacob Evelyn reporting a number of issues around command injection, there are several improvements.

Use of backticks as targets of a call will now be checked for command injection.

For example:

`blah #{something}` == "expected output"

Previously, use of backticks was not being indexed in this case.

(changes)

Somewhat similarly, other calls (such as system) would not warn if they were targets of a call.

(changes)

Brakeman will no longer warn about Process.pid in system calls.

(changes)

Also fixed an issue where searching for string interpolation would return the innermost instance instead of the first instance (typically you want the first one).

(changes)

Freeze Calls

Calls to String#freeze will essentially be ignored.

"blah".freeze

will be treated like

"blah"

(changes)

More Strong Parameters in SQL

Calls to to_h and to_hash on params will be ignored in the context of SQL injection.

(changes)

Sanitize in link_to

Brakeman will now warn on uses of sanitize in attempts to avoid XSS in link_to. Unfortunately, it does not work that way.

(changes)

Array#join to String Interpolation

Uses of Array#join will now be converted to string interpolation.

For example:

[1, thing, "here"].join(' ')

will be changed to

"1 #{thing} here"

This both fixes some false positives and helps detect more vulnerabilities in checks that are looking at string interpolation.

(changes)

Parent Calls

Brakeman now tracks the parent method call (I’m sure there’s a better way to say that) of an argument. While this ended up not being needed for this release, it will help improve checks and messages in the future.

(changes)