class Brakeman::ErubisTemplateProcessor
Processes ERB templates using Erubis instead of erb.
Public Instance Methods
process_attrasgn(exp)
click to toggle source
Look for assignments to output buffer that look like this:
@output_buffer.append = some_output @output_buffer.safe_append = some_output @output_buffer.safe_expr_append = some_output
Calls superclass method
Brakeman::BaseProcessor#process_attrasgn
# File lib/brakeman/processors/erubis_template_processor.rb, line 63 def process_attrasgn exp if exp.target.node_type == :ivar and exp.target.value == :@output_buffer if append_method?(exp.method) exp.first_arg = process(exp.first_arg) arg = normalize_output(exp.first_arg) if arg.node_type == :str ignore elsif safe_append_method?(exp.method) add_output arg else add_escaped_output arg end else super end else super end end
process_block(exp)
click to toggle source
Process blocks, ignoring :ignore exps
# File lib/brakeman/processors/erubis_template_processor.rb, line 43 def process_block exp exp = exp.dup exp.shift exp.map! do |e| res = process e if res.empty? or res == ignore nil else res end end block = Sexp.new(:rlist).concat(exp).compact block.line(exp.line) block end
process_call(exp)
click to toggle source
s(:call, TARGET, :method, ARGS)
# File lib/brakeman/processors/erubis_template_processor.rb, line 7 def process_call exp target = exp.target if sexp? target target = process target end exp.target = target exp.arglist = process exp.arglist method = exp.method #_buf is the default output variable for Erubis if node_type?(target, :lvar, :ivar) and (target.value == :_buf or target.value == :@output_buffer) if method == :<< or method == :safe_concat arg = normalize_output(exp.first_arg) if arg.node_type == :str #ignore plain strings ignore elsif node_type? target, :ivar and target.value == :@output_buffer add_escaped_output arg else add_output arg end elsif method == :to_s ignore else abort "Unrecognized action on buffer: #{method}" end elsif target == nil and method == :render make_render_in_view exp else exp end end
Private Instance Methods
append_method?(method)
click to toggle source
# File lib/brakeman/processors/erubis_template_processor.rb, line 85 def append_method?(method) method == :append= || safe_append_method?(method) end
safe_append_method?(method)
click to toggle source
# File lib/brakeman/processors/erubis_template_processor.rb, line 89 def safe_append_method?(method) method == :safe_append= || method == :safe_expr_append= end