Happy new year and apologies for the delay in releases! Brakeman should now return to the normal 1-2 month release cycle. There are already pull requests lined up for the next release.
-
-
This release includes a number of fixes and new features. In particular, please note there are large changes to how reports and warning messages are generated. Please report any issues!
-
-
Also, the brakeman
gem version of this release no longer supports use of Slim with Ruby 1.9.3. See below for details.
-
-
As noted previously, due to the Synopsys acquisition Brakeman is now distributed under a non-OSS license. See below for details.
-
-
Changes since 4.3.1:
-
-
- - Add check for CVE-2018-3760
- - Add
--enable
option to enable optional checks
- - Add Dockerfile to run Brakeman inside Docker (Ryan Kemper)
- - Handle empty
secrets.yml
files (Naoki Kimura)
- - Ignore Tempfiles in FileAccess warnings (Christina Koller)
- - Avoid warning about command injection when
String#shellescape
and Shellwords.shelljoin
are used (George Ogata)
- - Treat
if not
like unless
(#1225)
- - Fix Rails 4 configuration handling
- - Set default encoding to UTF-8
- - Support reading gem versions from gemspecs
- - Support gem versions which are just major.minor (e.g. 3.0)
- - Correctly set
rel="noreferrer"
in HTML reports
- - Fix thread-safety issue in CallIndex
- - Fix trim mode for ERb templates in old Rails versions
- - Avoid
nil
errors when concatenating arrays
- - Add rendered template information to render paths
- - Trim some unnecessary files from bundled gems
- - Deadcode and typo fixes found via Coverity
- - Complete overhaul of warning message construction
- - Update to Slim 4.0.1 (Jake Peterson)
- - Update to RubyParser 3.12.0
- - Updated license
-
-
-
CVE-2018-3760
-
-
A new check was added for CVE-2018-3760 (Sprockets path traversal vulnerability).
-Brakeman will warn about use of the affected Sprockets version and config.assets.compile = true
.
-
-
(changes)
-
-
Enable Optional Checks
-
-
Brakeman has options to enable all checks, to disable some checks, and to enable a subset of checks, but not to enable default+some optional checks.
-
-
The --enable
option has been added to allow enabling individual optional checks.
-
-
(changes)
-
-
Docker Support
-
-
Thanks to Ryan Kemper, Brakeman now has a Dockerfile to enable local building and running of Brakeman inside Docker.
-
-
Additionally, there is now a Docker image available for Brakeman:
-
-
docker pull presidentbeef/brakeman
-docker run -v "$(pwd)":/code brakeman --color
-
-
-
See the Brakeman README for more details.
-
-
Please note the Docker image is built from the master Brakeman branch. The master branch is typically stable, but it will typically be ahead of the gem release.
-
-
(changes)
-
-
Empty Secrets
-
-
Thanks to Naoki Kimura, Brakeman will no longer show an error when the secrets.yml
file is empty.
-
-
(changes)
-
-
File Access with Tempfiles
-
-
Thanks to Christina Koller, Brakeman will no longer warn about file access issues when Tempfiles are used.
-
-
(changes)
-
-
Shellescape and Command Injection
-
-
Thanks to George Ogata, Brakeman will no longer warn about command injection when shelljoin
or shellescape
are used.
-
-
(changes)
-
-
Rails 4 Configuration
-
-
When implementing the check for CVE-2018-3760, it was discovered that Brakeman was not handling the Rails 4 configuration format properly:
-
-
Brakeman was not picking up any configuration options if this format was used:
-
-
<AppName>.application.configure do
- #...
-end
-
-
-
(changes)
-
-
Default Encoding
-
-
Brakeman now sets the default external encoding to UTF-8
to avoid issues where the environment might set a different encoding.
-
-
(changes)
-
-
Gem Versions
-
-
Brakeman can now read gem versions from gemspec
files. This is common for Rails engines.
-
-
Additionally, Brakeman now understands versions which only specify major/minor versions (e.g. ~>4.0
).
-
-
The order of precedence is Gemfile.lock
> Gemfile
> *.gemspec
.
-
-
(changes)
-
-
No Referrer in HTML Reports
-
-
Brakeman has unfortunately been setting rel="no-referrer"
instead of rel="noreferrer"
in HTML reports.
-
-
(changes)
-
-
Thread-Safety in Call Index
-
-
In rare cases (heavy CPU load?), accessing the CallIndex when running checks caused thread-unsafe behavior. This would have been reflected in a Ruby error about modifying the index during iteration, although checks don’t actual modify the CallIndex.
-
-
(changes)
-
-
ERb Trim Mode
-
-
Brakeman has been accidentally setting the “trim mode” to the template file path (oops!) which silently (!) worked in tests. This only affects Rails 2.x.
-
-
This has been corrected and Ruby will now warn about incorrect trim modes.
-
-
(changes)
-
-
Array Joins
-
-
This release fixes a nil
error when attempting to concatenate arrays.
-
-
(changes)
-
-
-
-
Template “render paths” now include which template was rendered.
-
-
This is reflected in the JSON report:
-
-
"render_path": [
- {
- "type": "controller",
- "class": "HomeController",
- "method": "test_to_json",
- "line": 148,
- "file": "app/controllers/home_controller.rb",
- "rendered": {
- "name": "home/test_to_json",
- "file": "app/views/home/test_to_json.html.erb"
- }
- }
- ]
-
-
-
In the future this information may be used to improve other report formats as well.
-
-
(changes
-
-
Reduced Gem Size
-
-
The brakeman
gem bundles all its dependencies, which makes the gem a bit big.
-
-
This change removes some of the unneeded files (such as tests) and reduces the file size by about a third.
-
-
(changes)
-
-
Dead Code and Typos
-
-
A few bits of dead code and minor typos were found via Coverity and fixed.
-
-
Warning Message Overhaul
-
-
Brakeman warning messages were previously just strings.
-
-
In order to introduce some formatting flexibility, Brakeman warning messages are now constructed as arrays of Message
objects.
-These objects specify the type of the message string (e.g. “code” or “plain”). At report generation time, the messages can be converted to a particular format,
-such as HTML, plaintext, etc.
-
-
Along with this change, quite a bit of cleanup was performed on report generation in general.
-
-
These changes make it easier to produce consistent messages as well as potentially supporting translation in the future.
-
-
You may notice warning message text and/or formatting has changed as a result of these changes.
-Please report any issues.
-
-
(changes)
-
-
Dependency Updates
-
-
Thanks to Jake Peterson, the Slim dependency has been updated to 4.0.1 to support newer syntax.
-
-
Note that Slim 4.x not longer supports Ruby 1.9.3. You may need to use the brakeman-lib
gem or update your Ruby version.
-
-
(changes)
-
-
RubyParser has been updated to 3.12.0 which includes some added syntax support and is faster!
-
-
-
-
-
(changes)
-
-
New License
-
-
Brakeman is now distributed under the Brakeman Public Use License which restricts commercial use of Brakeman.
-
-
It does not restrict use of Brakeman to scan your own code or your organization’s code, regardless of whether that code is proprietary, commercial, free, open source, etc.
-
-
Feel free to message @presidentbeef if you have questions.
-
-
(changes)
-
-
Checksums
-
-
The SHA256 sums for this release are:
-
-
d3204cfe9d26782954ee8805fd748d11e8f950d2c1aee7c806c1856f273ee3b9 brakeman-4.4.0.gem
-88849f05b1c85756fee8974b8061383493714676187af3b94b6a7978a7e1e58d brakeman-lib-4.4.0.gem
-0417c20b0b6dab00c5cf5e9341868dc5d8139bca463bf45fefa925cac286127e brakeman-min-4.4.0.gem
-
-
-
Reporting Issues
-
-
Thank you to everyone who reported bugs and contributed to this release!
-
-
Please report any issues with this release. Take a look at this guide to reporting Brakeman problems.
-
-
Follow @brakeman on Twitter and hang out on Gitter for questions and discussion.
-
-
-
-
-
-