Included Modules

Class/Module Index [+]

Quicksearch

Brakeman::TemplateAliasProcessor

Processes aliasing in templates. Handles calls to render.

Public Class Methods

new(tracker, template, called_from = nil) click to toggle source
# File lib/brakeman/processors/template_alias_processor.rb, line 13
def initialize tracker, template, called_from = nil
  super tracker
  @template = template
  @called_from = called_from
end

Public Instance Methods

find_push_target(exp) click to toggle source

Ignore `<<` calls on template variables which are used by the templating library (HAML, ERB, etc.)

# File lib/brakeman/processors/template_alias_processor.rb, line 105
def find_push_target exp
  if sexp? exp
    if exp.node_type == :lvar and (exp.value == :_buf or exp.value == :_erbout)
      return nil
    elsif exp.node_type == :ivar and exp.value == :@output_buffer
      return nil
    elsif exp.node_type == :call and call? exp.target and
      exp.target.method == :_hamlout and exp.method == :buffer

      return nil
    end
  end

  super
end
get_model_target(exp) click to toggle source

Checks if exp is a call to Model.all or Model.find*

# File lib/brakeman/processors/template_alias_processor.rb, line 82
def get_model_target exp
  if call? exp
    target = exp.target

    if exp.method == :all or exp.method.to_s[0,4] == "find"
      models = Set.new @tracker.models.keys

      begin
        name = class_name target
        return target if models.include?(name)
      rescue StandardError
      end

    end

    return get_model_target(target)
  end

  false
end
process_call_with_block(exp) click to toggle source

Looks for form methods and iterating over collections of Models

# File lib/brakeman/processors/template_alias_processor.rb, line 45
def process_call_with_block exp
  process_default exp

  call = exp.block_call

  if call? call
    target = call.target
    method = call.method
    arg = exp.block_args.first_param
    block = exp.block

    #Check for e.g. Model.find.each do ... end
    if method == :each and arg and block and model = get_model_target(target)
      if arg.is_a? Symbol
        if model == target.target
          env[Sexp.new(:lvar, arg)] = Sexp.new(:call, model, :new)
        else
          env[Sexp.new(:lvar, arg)] = UNKNOWN_MODEL_CALL
        end

        process block if sexp? block
      end
    elsif FORM_METHODS.include? method
      if arg.is_a? Symbol
        env[Sexp.new(:lvar, arg)] = FORM_BUILDER_CALL

        process block if sexp? block
      end
    end
  end

  exp
end
Also aliased as: process_iter
process_iter(exp) click to toggle source
process_template(name, args) click to toggle source

Process template

# File lib/brakeman/processors/template_alias_processor.rb, line 20
def process_template name, args
  if @called_from
    unless @called_from.grep(/Template:#{name}$/).empty?
      Brakeman.debug "Skipping circular render from #{@template[:name]} to #{name}"
      return
    end

    super name, args, @called_from + ["Template:#{@template[:name]}"]
  else
    super name, args, ["Template:#{@template[:name]}"]
  end
end
template_name(name) click to toggle source

Determine template name

# File lib/brakeman/processors/template_alias_processor.rb, line 34
def template_name name
  unless name.to_s.include? "/"
    name = "#{@template[:name].to_s.match(/^(.*\/).*$/)[1]}#{name}"
  end
  name
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.