presidentbeef / brakeman

A static analysis security vulnerability scanner for Ruby on Rails applications
https://brakemanscanner.org/
Other
7.02k stars 732 forks source link

Need to extend Slim with shortcuts #652

Open aishek opened 9 years ago

aishek commented 9 years ago

I need to extend Slim with shortcuts, but Brakeman shows shortcuts in templates as errors.

shortcut = Slim::Parser.options[:shortcut]
shortcut['@']  = { attr: 'data-role' }
shortcut['@@'] = { attr: 'data-block' }
Slim::Engine.options[:merge_attrs]['data-role']  = ' '
Slim::Engine.options[:merge_attrs]['data-block'] = ' '

Is it possible to extend Slim with shortcuts for Brakeman?

presidentbeef commented 9 years ago

Hi Alexandr,

Yes, this should be possible. Where is this set? In an initializer?

aishek commented 9 years ago

Hi Justin,

I am using initializer from engine: https://github.com/ai/evil-blocks/blob/master/lib/evil-blocks-rails.rb

presidentbeef commented 9 years ago

Oh. I'm not sure how that would work, then.

aishek commented 9 years ago

I created initializer:

# config/initializers/brakeman_slim.rb

if defined?(Slim::Parser)
  shortcut = Slim::Parser.options[:shortcut]
  shortcut['@']  = { attr: 'data-role' }
  shortcut['@@'] = { attr: 'data-block' }
  Slim::Engine.options[:merge_attrs]['data-role']  = ' '
  Slim::Engine.options[:merge_attrs]['data-block'] = ' '
end

Run brakeman, and got Unknown line indicator error on the template:

@@test
  | Hello
presidentbeef commented 9 years ago

If the initializer is defined inside your project, then I can make Brakeman work with it.

aishek commented 9 years ago

Justin, thank you very much, I'd like to make pull request by myself. If I add code to brakeman, which will load config/brakeman.rb if present, where developer could put slim settings or other, it will be ok?

presidentbeef commented 9 years ago

No, Brakeman cannot execute any code from the application, as that would be a security issue.

aishek commented 9 years ago

I'm stuck, Justin, please help :) Is there any possibility to told brakeman to use Slim shortcuts?

presidentbeef commented 9 years ago

Yes, but it won't be very straightforward, sorry. Brakeman will need to read the shortcuts from the initializer and then set them when actually processing the Slim templates.

aishek commented 9 years ago

Ok, thanks.