presidentbeef/brakeman

View on GitHub

Showing 51 of 53 total issues

Avoid deeply nested control flow statements.
Open

          elsif node_type? last_arg, :nil, :false
            #layout :false or layout nil
            @current_class.layout = false
Severity: Major
Found in lib/brakeman/processors/controller_processor.rb - About 45 mins to fix

    Avoid deeply nested control flow statements.
    Open

              process block if sexp? block
    Severity: Major
    Found in lib/brakeman/processors/template_alias_processor.rb - About 45 mins to fix

      Avoid deeply nested control flow statements.
      Open

                if exp.value.node_type == :rlist
                  exp.value.each_sexp do |e|
                    match = has_immediate_user_input?(e)
                    return match if match
                  end
      Severity: Major
      Found in lib/brakeman/checks/base_check.rb - About 45 mins to fix

        Avoid deeply nested control flow statements.
        Open

                              if $4 == "true"
                                if string_interp? out
                                  build_output_from_push_text(out, :escaped_output)
                                else
                                  Sexp.new :format_escaped, out
        Severity: Major
        Found in lib/brakeman/processors/haml_template_processor.rb - About 45 mins to fix

          Avoid deeply nested control flow statements.
          Open

                      return match if match
          Severity: Major
          Found in lib/brakeman/checks/base_check.rb - About 45 mins to fix

            Avoid deeply nested control flow statements.
            Open

                      if exp.value.node_type == :rlist
                        exp.value.each_sexp do |e|
                          if match = has_immediate_model?(e, out)
                            return match
                          end
            Severity: Major
            Found in lib/brakeman/checks/base_check.rb - About 45 mins to fix

              Avoid deeply nested control flow statements.
              Open

                         if string? v
                           add_route_from_string v[1]
                         elsif in_controller_block? and symbol? v
                           add_route v
                         end
              Severity: Major
              Found in lib/brakeman/processors/lib/rails3_route_processor.rb - About 45 mins to fix

                Avoid deeply nested control flow statements.
                Open

                            return match if match
                Severity: Major
                Found in lib/brakeman/checks/base_check.rb - About 45 mins to fix

                  Avoid deeply nested control flow statements.
                  Open

                              if exp.method == :to_json
                                message << msg_plain(" in JSON hash")
                                link_path += "_to_json"
                                warning_code = :xss_to_json
                              end
                  Severity: Major
                  Found in lib/brakeman/checks/check_cross_site_scripting.rb - About 45 mins to fix

                    Avoid deeply nested control flow statements.
                    Open

                                if t.is_a? Symbol
                                  :"#{t}.#{exp.method}"
                                else
                                  exp
                                end
                    Severity: Major
                    Found in lib/brakeman/processors/lib/find_all_calls.rb - About 45 mins to fix

                      Avoid deeply nested control flow statements.
                      Open

                                  if @app_tree.layout_exists?(name)
                                    @current_class.layout = "layouts/#{name}"
                                  else
                                    Brakeman.debug "[Notice] Layout not found: #{name}"
                                  end
                      Severity: Major
                      Found in lib/brakeman/processors/controller_processor.rb - About 45 mins to fix

                        Similar blocks of code found in 2 locations. Consider refactoring.
                        Open

                          def cookies? exp
                            if exp.is_a? Sexp
                              return true if exp.node_type == :cookies or ALL_COOKIES.include? exp
                        
                              if call? exp
                        Severity: Minor
                        Found in lib/brakeman/util.rb and 1 other location - About 45 mins to fix
                        lib/brakeman/util.rb on lines 230..243

                        Duplicated Code

                        Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                        Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                        When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                        Tuning

                        This issue has a mass of 40.

                        We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                        The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                        If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                        See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                        Refactorings

                        Further Reading

                        Avoid deeply nested control flow statements.
                        Open

                                  if string? v
                                    add_route_from_string v
                                  else
                                    add_route v
                                  end
                        Severity: Major
                        Found in lib/brakeman/processors/lib/rails3_route_processor.rb - About 45 mins to fix

                          Similar blocks of code found in 2 locations. Consider refactoring.
                          Open

                            def params? exp
                              if exp.is_a? Sexp
                                return true if exp.node_type == :params or ALL_PARAMETERS.include? exp
                          
                                if call? exp
                          Severity: Minor
                          Found in lib/brakeman/util.rb and 1 other location - About 45 mins to fix
                          lib/brakeman/util.rb on lines 246..259

                          Duplicated Code

                          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                          Tuning

                          This issue has a mass of 40.

                          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                          Refactorings

                          Further Reading

                          Identical blocks of code found in 2 locations. Consider refactoring.
                          Open

                            def get_rails_config exp
                              if node_type? exp, :attrasgn
                                attribute = exp.method.to_s[0..-2].to_sym
                                get_rails_config(exp.target) << attribute
                              elsif call? exp
                          Severity: Minor
                          Found in lib/brakeman/processors/lib/rails3_config_processor.rb and 1 other location - About 40 mins to fix
                          lib/brakeman/processors/lib/rails2_config_processor.rb on lines 107..119

                          Duplicated Code

                          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                          Tuning

                          This issue has a mass of 38.

                          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                          Refactorings

                          Further Reading

                          Identical blocks of code found in 2 locations. Consider refactoring.
                          Open

                            def get_rails_config exp
                              if node_type? exp, :attrasgn
                                attribute = exp.method.to_s[0..-2].to_sym
                                get_rails_config(exp.target) << attribute
                              elsif call? exp
                          Severity: Minor
                          Found in lib/brakeman/processors/lib/rails2_config_processor.rb and 1 other location - About 40 mins to fix
                          lib/brakeman/processors/lib/rails3_config_processor.rb on lines 118..130

                          Duplicated Code

                          Duplicated code can lead to software that is hard to understand and difficult to change. The Don't Repeat Yourself (DRY) principle states:

                          Every piece of knowledge must have a single, unambiguous, authoritative representation within a system.

                          When you violate DRY, bugs and maintenance problems are sure to follow. Duplicated code has a tendency to both continue to replicate and also to diverge (leaving bugs as two similar implementations differ in subtle ways).

                          Tuning

                          This issue has a mass of 38.

                          We set useful threshold defaults for the languages we support but you may want to adjust these settings based on your project guidelines.

                          The threshold configuration represents the minimum mass a code block must have to be analyzed for duplication. The lower the threshold, the more fine-grained the comparison.

                          If the engine is too easily reporting duplication, try raising the threshold. If you suspect that the engine isn't catching enough duplication, try lowering the threshold. The best setting tends to differ from language to language.

                          See codeclimate-duplication's documentation for more information about tuning the mass threshold in your .codeclimate.yml.

                          Refactorings

                          Further Reading

                          Consider simplifying this complex logical expression.
                          Open

                              if node_type? exp, :or
                                decorated_model? exp.lhs or decorated_model? exp.rhs
                              else
                                tracker.config.has_gem? :draper and
                                call? exp and
                          Severity: Major
                          Found in lib/brakeman/checks/check_redirect.rb - About 40 mins to fix

                            Consider simplifying this complex logical expression.
                            Open

                                if call? target and target.method == :connection
                                  target = target.target
                                  klass = class_name(target)
                            
                                  target.nil? or
                            Severity: Major
                            Found in lib/brakeman/checks/check_sql.rb - About 40 mins to fix

                              Consider simplifying this complex logical expression.
                              Open

                                  if method == :redirect_to and
                                      not only_path?(call) and
                                      not explicit_host?(opt) and
                                      not slice_call?(opt) and
                                      not safe_permit?(opt) and
                              Severity: Major
                              Found in lib/brakeman/checks/check_redirect.rb - About 40 mins to fix

                                Method render_warnings has 5 arguments (exceeds 4 allowed). Consider refactoring.
                                Open

                                  def render_warnings warnings, type, template, cols, sort_col
                                Severity: Minor
                                Found in lib/brakeman/report/report_table.rb - About 35 mins to fix
                                  Severity
                                  Category
                                  Status
                                  Source
                                  Language