upgrading is recommended, no workarounds
https://groups.google.com/group/rubyonrails-security/browse_thread/thread/edd28f1e3d04e913?pli=1

http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664

since most development is done with 1.9.3 now

fixes bug where resource routes attempted to merge into
:allow_all_actions

because before they were kind of all over the place

instead of "sexp? exp and exp.node_type == :blah"
or "sexp? exp and exp[0] == :blah"

instead of returning false for options[:exit_on_warn]

because sometimes that row gets modified and subsequent
calls to Warning#to_row will return the modified version
thereby breaking things.

instead of when reporting, which lead to confusion
and filtering all over the place instead of in one place.

fixes #47

Catch raw hrefs as bad, warn unless wrapped in a "safe" method

Avoid some processing by checking for duplicates first

Add concept of a safe-ening method to mark hrefs as safe

Feature:
Warn when using unsafe hrefs.  This is a very specific case that as of now produces a ton of noise.  This came out of an xss vuln where the value was escaped but still vulnerable.

    link_to 'asdf', h(@scary)

where

    @scary = 'javascript:alert(1)'

or

    @scary = 'data:  # http://palpapers.plynt.com/issues/2010Oct/bypass-xss-filters/

This branch accomplishes slightly intelligent warnings by adding a new command line option to declare methods that make a string URL safe (unless there is already a standard one out there).  e.g.:

    $ brakeman . --url-safe-methods ensure_valid_protocol!

    link_to 'asdf', ensure_valid_protocol!(@scary, :javascript)

[ci skip]

this is the real cutoff for 1.3.0

[ci skip]

closes #44