class Brakeman::Rails3Erubis

This is from Rails 5 version of the Erubis handler github.com/rails/rails/blob/ec608107801b1e505db03ba76bae4a326a5804ca/actionview/lib/action_view/template/handlers/erb.rb#L7-L73

Constants

BLOCK_EXPR

Public Instance Methods

add_expr(src, code, indicator) click to toggle source

Erubis toggles <%= and <%== behavior when escaping is enabled. We override to always treat <%== as escaped.

Calls superclass method
# File lib/brakeman/parsers/rails3_erubis.rb, line 33
def add_expr(src, code, indicator)
  case indicator
  when '=='
    add_expr_escaped(src, code)
  else
    super
  end
end
add_expr_escaped(src, code) click to toggle source
# File lib/brakeman/parsers/rails3_erubis.rb, line 53
def add_expr_escaped(src, code)
  flush_newline_if_pending(src)
  if code =~ BLOCK_EXPR
    src << "@output_buffer.safe_expr_append= " << code
  else
    src << "@output_buffer.safe_expr_append=(" << code << ");"
  end
end
add_expr_literal(src, code) click to toggle source
# File lib/brakeman/parsers/rails3_erubis.rb, line 44
def add_expr_literal(src, code)
  flush_newline_if_pending(src)
  if code =~ BLOCK_EXPR
    src << '@output_buffer.append= ' << code
  else
    src << '@output_buffer.append=(' << code << ');'
  end
end
add_postamble(src) click to toggle source
# File lib/brakeman/parsers/rails3_erubis.rb, line 67
def add_postamble(src)
  flush_newline_if_pending(src)
  src << '@output_buffer.to_s; }'
end
add_preamble(src) click to toggle source
# File lib/brakeman/parsers/rails3_erubis.rb, line 10
def add_preamble(src)
  @newline_pending = 0
  src << "_this_is_to_make_yields_syntactally_correct {"
  src << "@output_buffer = output_buffer || ActionView::OutputBuffer.new;"
end
add_stmt(src, code) click to toggle source
Calls superclass method
# File lib/brakeman/parsers/rails3_erubis.rb, line 62
def add_stmt(src, code)
  flush_newline_if_pending(src)
  super
end
add_text(src, text) click to toggle source
# File lib/brakeman/parsers/rails3_erubis.rb, line 16
def add_text(src, text)
  return if text.empty?

  if text == "\n"
    @newline_pending += 1
  else
    src << "@output_buffer.safe_append='"
    src << "\n" * @newline_pending if @newline_pending > 0
    src << escape_text(text)
    src << "'.freeze;"

    @newline_pending = 0
  end
end
convert_input(src, input) click to toggle source

This is borrowed from graphql’s erb plugin: github.com/github/graphql-client/blob/51e76bd8d8b2ac0021d8fef7468b9a294e4bd6e8/lib/graphql/client/erubis.rb#L33-L38

Calls superclass method
# File lib/brakeman/parsers/rails3_erubis.rb, line 81
def convert_input(src, input)
  input = input.gsub(/<%graphql/, "<%#")
  super(src, input)
end
flush_newline_if_pending(src) click to toggle source
# File lib/brakeman/parsers/rails3_erubis.rb, line 72
def flush_newline_if_pending(src)
  if @newline_pending > 0
    src << "@output_buffer.safe_append='#{"\n" * @newline_pending}'.freeze;"
    @newline_pending = 0
  end
end