diff --git a/Gemfile.lock b/Gemfile.lock index 428133124..7d8fd4fac 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -118,7 +118,7 @@ GEM bigdecimal (3.1.9) bootsnap (1.18.4) msgpack (~> 1.2) - brakeman (6.2.2) + brakeman (7.0.0) racc builder (3.3.0) capybara (3.40.0) @@ -131,7 +131,7 @@ GEM regexp_parser (>= 1.5, < 3.0) xpath (~> 3.2) chunky_png (1.4.0) - concurrent-ruby (1.3.4) + concurrent-ruby (1.3.5) connection_pool (2.5.0) crass (1.0.6) date (3.4.1) @@ -162,25 +162,26 @@ GEM addressable (>= 2.5.0) globalid (1.2.1) activesupport (>= 6.1) - hotwire-spark (0.1.12) + hotwire-spark (0.1.13) listen rails (>= 7.0.0) zeitwerk - i18n (1.14.6) + i18n (1.14.7) concurrent-ruby (~> 1.0) importmap-rails (2.1.0) actionpack (>= 6.0.0) activesupport (>= 6.0.0) railties (>= 6.0.0) io-console (0.8.0) - irb (1.14.3) + irb (1.15.1) + pp (>= 0.6.0) rdoc (>= 4.0.0) reline (>= 0.4.2) jbuilder (2.13.0) actionview (>= 5.0.0) activesupport (>= 5.0.0) - json (2.9.0) - kamal (2.4.0) + json (2.10.1) + kamal (2.5.3) activesupport (>= 7.0) base64 (~> 0.2) bcrypt_pbkdf (~> 1.0) @@ -191,11 +192,12 @@ GEM sshkit (>= 1.23.0, < 2.0) thor (~> 1.3) zeitwerk (>= 2.6.18, < 3.0) - language_server-protocol (3.17.0.3) + language_server-protocol (3.17.0.4) + lint_roller (1.1.0) listen (3.9.0) rb-fsevent (~> 0.10, >= 0.10.3) rb-inotify (~> 0.9, >= 0.9.10) - logger (1.6.4) + logger (1.6.6) loofah (2.24.0) crass (~> 1.0.2) nokogiri (>= 1.12.0) @@ -209,7 +211,7 @@ GEM mini_mime (1.1.5) mini_portile2 (2.8.8) minitest (5.25.4) - msgpack (1.7.5) + msgpack (1.8.0) net-imap (0.5.6) date net-protocol @@ -221,7 +223,7 @@ GEM net-ssh (>= 2.6.5, < 8.0.0) net-sftp (4.0.0) net-ssh (>= 5.0.0, < 8.0.0) - net-smtp (0.5.0) + net-smtp (0.5.1) net-protocol net-ssh (7.3.0) nio4r (2.7.4) @@ -246,19 +248,22 @@ GEM racc (~> 1.4) ostruct (0.6.1) parallel (1.26.3) - parser (3.3.6.0) + parser (3.3.7.1) ast (~> 2.4.1) racc + pp (0.6.2) + prettyprint + prettyprint (0.2.0) propshaft (1.1.0) actionpack (>= 7.0.0) activesupport (>= 7.0.0) rack railties (>= 7.0.0) - psych (5.2.2) + psych (5.2.3) date stringio public_suffix (6.0.1) - puma (6.5.0) + puma (6.6.0) nio4r (~> 2.0) raabro (1.4.0) racc (1.8.1) @@ -282,109 +287,109 @@ GEM rb-fsevent (0.11.2) rb-inotify (0.11.1) ffi (~> 1.0) - rdoc (6.10.0) + rdoc (6.12.0) psych (>= 4.0.0) - redcarpet (3.6.0) - regexp_parser (2.9.3) + redcarpet (3.6.1) + regexp_parser (2.10.0) reline (0.6.0) io-console (~> 0.5) - rexml (3.3.9) + rexml (3.4.1) rouge (4.5.1) rqrcode (2.2.0) chunky_png (~> 1.0) rqrcode_core (~> 1.0) rqrcode_core (1.2.0) - rubocop (1.69.1) + rubocop (1.73.2) json (~> 2.3) - language_server-protocol (>= 3.17.0) + language_server-protocol (~> 3.17.0.2) + lint_roller (~> 1.1.0) parallel (~> 1.10) parser (>= 3.3.0.2) rainbow (>= 2.2.2, < 4.0) regexp_parser (>= 2.9.3, < 3.0) - rubocop-ast (>= 1.36.2, < 2.0) + rubocop-ast (>= 1.38.0, < 2.0) ruby-progressbar (~> 1.7) unicode-display_width (>= 2.4.0, < 4.0) - rubocop-ast (1.36.2) + rubocop-ast (1.38.1) parser (>= 3.3.1.0) - rubocop-minitest (0.36.0) - rubocop (>= 1.61, < 2.0) - rubocop-ast (>= 1.31.1, < 2.0) - rubocop-performance (1.23.0) - rubocop (>= 1.48.1, < 2.0) - rubocop-ast (>= 1.31.1, < 2.0) - rubocop-rails (2.27.0) + rubocop-performance (1.24.0) + lint_roller (~> 1.1) + rubocop (>= 1.72.1, < 2.0) + rubocop-ast (>= 1.38.0, < 2.0) + rubocop-rails (2.30.3) activesupport (>= 4.2.0) + lint_roller (~> 1.1) rack (>= 1.1) - rubocop (>= 1.52.0, < 2.0) - rubocop-ast (>= 1.31.1, < 2.0) - rubocop-rails-omakase (1.0.0) - rubocop - rubocop-minitest - rubocop-performance - rubocop-rails + rubocop (>= 1.72.1, < 2.0) + rubocop-ast (>= 1.38.0, < 2.0) + rubocop-rails-omakase (1.1.0) + rubocop (>= 1.72) + rubocop-performance (>= 1.24) + rubocop-rails (>= 2.30) ruby-progressbar (1.13.0) - rubyzip (2.3.2) + rubyzip (2.4.1) securerandom (0.4.1) - selenium-webdriver (4.27.0) + selenium-webdriver (4.29.1) base64 (~> 0.2) logger (~> 1.4) rexml (~> 3.2, >= 3.2.5) rubyzip (>= 1.2.2, < 3.0) websocket (~> 1.0) - sentry-rails (5.22.1) + sentry-rails (5.22.4) railties (>= 5.0) - sentry-ruby (~> 5.22.1) - sentry-ruby (5.22.1) + sentry-ruby (~> 5.22.4) + sentry-ruby (5.22.4) bigdecimal concurrent-ruby (~> 1.0, >= 1.0.2) - solid_cable (3.0.5) + solid_cable (3.0.7) actioncable (>= 7.2) activejob (>= 7.2) activerecord (>= 7.2) railties (>= 7.2) - solid_cache (1.0.6) + solid_cache (1.0.7) activejob (>= 7.2) activerecord (>= 7.2) railties (>= 7.2) - solid_queue (1.1.2) + solid_queue (1.1.3) activejob (>= 7.1) activerecord (>= 7.1) concurrent-ruby (>= 1.3.1) fugit (~> 1.11.0) railties (>= 7.1) thor (~> 1.3.1) - sqlite3 (2.5.0-aarch64-linux-gnu) - sqlite3 (2.5.0-aarch64-linux-musl) - sqlite3 (2.5.0-arm-linux-gnu) - sqlite3 (2.5.0-arm-linux-musl) - sqlite3 (2.5.0-arm64-darwin) - sqlite3 (2.5.0-x86-linux-gnu) - sqlite3 (2.5.0-x86-linux-musl) - sqlite3 (2.5.0-x86_64-darwin) - sqlite3 (2.5.0-x86_64-linux-gnu) - sqlite3 (2.5.0-x86_64-linux-musl) - sshkit (1.23.2) + sqlite3 (2.6.0-aarch64-linux-gnu) + sqlite3 (2.6.0-aarch64-linux-musl) + sqlite3 (2.6.0-arm-linux-gnu) + sqlite3 (2.6.0-arm-linux-musl) + sqlite3 (2.6.0-arm64-darwin) + sqlite3 (2.6.0-x86-linux-gnu) + sqlite3 (2.6.0-x86-linux-musl) + sqlite3 (2.6.0-x86_64-darwin) + sqlite3 (2.6.0-x86_64-linux-gnu) + sqlite3 (2.6.0-x86_64-linux-musl) + sshkit (1.24.0) base64 + logger net-scp (>= 1.1.2) net-sftp (>= 2.1.2) net-ssh (>= 2.8.0) ostruct stimulus-rails (1.3.4) railties (>= 6.0.0) - stringio (3.1.2) + stringio (3.1.5) thor (1.3.2) - thruster (0.1.10) - thruster (0.1.10-aarch64-linux) - thruster (0.1.10-arm64-darwin) - thruster (0.1.10-x86_64-darwin) - thruster (0.1.10-x86_64-linux) + thruster (0.1.12) + thruster (0.1.12-aarch64-linux) + thruster (0.1.12-arm64-darwin) + thruster (0.1.12-x86_64-darwin) + thruster (0.1.12-x86_64-linux) timeout (0.4.3) - turbo-rails (2.0.11) - actionpack (>= 6.0.0) - railties (>= 6.0.0) + turbo-rails (2.0.13) + actionpack (>= 7.1.0) + railties (>= 7.1.0) tzinfo (2.0.6) concurrent-ruby (~> 1.0) - unicode-display_width (3.1.2) + unicode-display_width (3.1.4) unicode-emoji (~> 4.0, >= 4.0.4) unicode-emoji (4.0.4) uri (1.0.3) @@ -396,7 +401,7 @@ GEM websocket-extensions (0.1.5) xpath (3.2.0) nokogiri (~> 1.8) - zeitwerk (2.7.1) + zeitwerk (2.7.2) PLATFORMS aarch64-linux diff --git a/config/brakeman.ignore b/config/brakeman.ignore index 59e4ff3e0..def63fdfe 100644 --- a/config/brakeman.ignore +++ b/config/brakeman.ignore @@ -1,28 +1,5 @@ { "ignored_warnings": [ - { - "warning_type": "SQL Injection", - "warning_code": 0, - "fingerprint": "058e1a992f5317dab046bf4f403fc4d5d01c288d7cbd8232526dcfed2add2ad2", - "check_name": "SQL", - "message": "Possible SQL injection", - "file": "app/models/message.rb", - "line": 9, - "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/", - "code": "joins(\"LEFT OUTER JOIN #{messageable_type} ON messages.messageable_id = #{messageable_type}.id\")", - "render_path": null, - "location": { - "type": "method", - "class": "Message", - "method": "left_joins_messageable" - }, - "user_input": "messageable_type", - "confidence": "Medium", - "cwe_id": [ - 89 - ], - "note": "" - }, { "warning_type": "SQL Injection", "warning_code": 0, @@ -30,7 +7,7 @@ "check_name": "SQL", "message": "Possible SQL injection", "file": "app/models/concerns/searchable.rb", - "line": 13, + "line": 14, "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/", "code": "joins(\"join #{using} idx on #{table_name}.id = idx.rowid\")", "render_path": null, @@ -45,8 +22,31 @@ 89 ], "note": "" + }, + { + "warning_type": "Dangerous Eval", + "warning_code": 13, + "fingerprint": "971ca740ceee7ae9a7d02a257964afd0b80672b3a4c49eeaf8a07a178bb84e78", + "check_name": "Evaluation", + "message": "Dynamic string evaluated as code", + "file": "lib/rails_ext/action_text_has_markdown.rb", + "line": 7, + "link": "https://brakemanscanner.org/docs/warning_types/dangerous_eval/", + "code": "class_eval(\" def #{name}\\n markdown_#{name} || build_markdown_#{name}\\n end\\n\\n def #{name}_html\\n #{name}.to_html\\n end\\n\\n def #{name}_plain_text\\n #{name}.to_plain_text\\n end\\n\\n def #{name}?\\n markdown_#{name}.present?\\n end\\n\\n def #{name}=(content)\\n self.#{name}.content = content\\n end\\n\", \"lib/rails_ext/action_text_has_markdown.rb\", 8)", + "render_path": null, + "location": { + "type": "method", + "class": "ActionText::HasMarkdown", + "method": "has_markdown" + }, + "user_input": null, + "confidence": "Weak", + "cwe_id": [ + 913, + 95 + ], + "note": "" } ], - "updated": "2024-10-27 20:18:14 -0600", - "brakeman_version": "6.2.2" + "brakeman_version": "7.0.0" }