diff --git a/lib/brakeman/processors/base_processor.rb b/lib/brakeman/processors/base_processor.rb index f36218a4b252c4547a4f604390899e46a87c40e4..daed8885ffd158e4699a25d6f63757bda57b63df 100644 --- a/lib/brakeman/processors/base_processor.rb +++ b/lib/brakeman/processors/base_processor.rb @@ -202,9 +202,14 @@ class Brakeman::BaseProcessor < SexpProcessor exp end + #Convenience method for `make_render exp, true` + def make_render_in_view exp + make_render exp, true + end + #Generates :render node from call to render. - def make_render exp - render_type, value, rest = find_render_type exp[3] + def make_render exp, in_view = false + render_type, value, rest = find_render_type exp[3], in_view rest = process rest result = Sexp.new(:render, render_type, value, rest) result.line(exp.line) @@ -214,9 +219,11 @@ class Brakeman::BaseProcessor < SexpProcessor #Determines the type of a call to render. # #Possible types are: - #:action, :default :file, :inline, :js, :json, :nothing, :partial, + #:action, :default, :file, :inline, :js, :json, :nothing, :partial, #:template, :text, :update, :xml - def find_render_type args + # + #And also :layout for inside templates + def find_render_type args, in_view = false rest = Sexp.new(:hash) type = nil value = nil @@ -244,10 +251,18 @@ class Brakeman::BaseProcessor < SexpProcessor value = args[1] end + types_in_hash = Set[:action, :file, :inline, :js, :json, :nothing, :partial, :text, :update, :xml] + + #render :layout => "blah" means something else when in a template + if in_view + types_in_hash << :layout + end + + #Look for "type" of render in options hash + #For example, render :file => "blah" if hash? args[-1] hash_iterate(args[-1]) do |key, val| - case key[1] - when :action, :file, :inline, :js, :json, :nothing, :partial, :text, :update, :xml + if types_in_hash.include? key[1] type = key[1] value = val else diff --git a/lib/brakeman/processors/erb_template_processor.rb b/lib/brakeman/processors/erb_template_processor.rb index 140c2bef43e37b5c0e8b05cdfbec5a4b5ac5c89d..9f749da06d8406ae2822384fa043a3323fb3173e 100644 --- a/lib/brakeman/processors/erb_template_processor.rb +++ b/lib/brakeman/processors/erb_template_processor.rb @@ -44,7 +44,7 @@ class Brakeman::ErbTemplateProcessor < Brakeman::TemplateProcessor end elsif target == nil and method == :render exp[3] = process(exp[3]) - make_render exp + make_render_in_view exp else args = exp[3] = process(exp[3]) call = Sexp.new :call, target, method, args diff --git a/lib/brakeman/processors/erubis_template_processor.rb b/lib/brakeman/processors/erubis_template_processor.rb index eeef289d6f14129fa961939c81b0355ed96a2cce..6a99a56506389f1c625b3b0615ad24c6a9e96ba1 100644 --- a/lib/brakeman/processors/erubis_template_processor.rb +++ b/lib/brakeman/processors/erubis_template_processor.rb @@ -41,7 +41,7 @@ class Brakeman::ErubisTemplateProcessor < Brakeman::TemplateProcessor end elsif target == nil and method == :render exp[3] = process exp[3] - make_render exp + make_render_in_view exp else args = exp[3] = process(exp[3]) call = Sexp.new :call, target, method, args diff --git a/lib/brakeman/processors/haml_template_processor.rb b/lib/brakeman/processors/haml_template_processor.rb index 59887afb34114ce0ab42aa9112ef84161120e492..df36940b54afb815bc0b7a629da012361082dafc 100644 --- a/lib/brakeman/processors/haml_template_processor.rb +++ b/lib/brakeman/processors/haml_template_processor.rb @@ -92,7 +92,7 @@ class Brakeman::HamlTemplateProcessor < Brakeman::TemplateProcessor elsif target == nil and method == :render #Process call to render() exp[3] = process exp[3] - make_render exp + make_render_in_view exp else args = process exp[3] call = Sexp.new :call, target, method, args diff --git a/lib/brakeman/processors/lib/render_helper.rb b/lib/brakeman/processors/lib/render_helper.rb index 6a7d4bcb453a5669364ae475e4b805e826dfc284..d15ed3a28d6796d298fcdab215be0abdd1cd4fd3 100644 --- a/lib/brakeman/processors/lib/render_helper.rb +++ b/lib/brakeman/processors/lib/render_helper.rb @@ -11,8 +11,13 @@ module Brakeman::RenderHelper when :action process_action exp[2][1], exp[3] when :default - process_template template_name, exp[3] - when :partial + begin + process_template template_name, exp[3] + rescue ArgumentError => e + Brakeman.debug "Problem processing render: #{exp}" + raise e + end + when :partial, :layout process_partial exp[2], exp[3] when :nothing end diff --git a/test/apps/rails3.1/app/views/users/_test_layout.html.erb b/test/apps/rails3.1/app/views/users/_test_layout.html.erb new file mode 100644 index 0000000000000000000000000000000000000000..38d25adf3fc72f60aa279d8443d35f5f69c81e3e --- /dev/null +++ b/test/apps/rails3.1/app/views/users/_test_layout.html.erb @@ -0,0 +1 @@ +<%= raw @something %> diff --git a/test/apps/rails3.1/app/views/users/index.html.erb b/test/apps/rails3.1/app/views/users/index.html.erb index 29f98611bfdb3e4482f5b9887ffb158a0363fc65..d09315399758d7bb5be02978c5cb1ee13c2eb7c8 100644 --- a/test/apps/rails3.1/app/views/users/index.html.erb +++ b/test/apps/rails3.1/app/views/users/index.html.erb @@ -29,3 +29,6 @@
<%= link_to 'New User', new_user_path %> + +<%= @something = params["something_bad"] %> +<%= render :layout => "test_layout" %>