<commit_before>require 'brakeman/checks/base_check'

#Check calls to +render()+ for dangerous values
class Brakeman::CheckRender < Brakeman::BaseCheck
  Brakeman::Checks.add self

  @description = "Finds calls to render that might allow file access"

  def run_check
    tracker.find_call(:target => nil, :method => :render).each do |result|
      process_render result
    end
  end

  def process_render result
    case result[:call].render_type
    when :partial, :template, :action, :file
      check_for_dynamic_path result
    when :inline
    when :js
    when :json
    when :text
    when :update
    when :xml
    end
  end

  #Check if path to action or file is determined dynamically
  def check_for_dynamic_path result
    view = result[:call][2]

    if sexp? view and not duplicate? result
      add_result result


      if input = has_immediate_user_input?(view)
        confidence = CONFIDENCE[:high]
      elsif input = include_user_input?(view)
        if node_type? view, :string_interp, :dstr
          confidence = CONFIDENCE[:med]
        else
          confidence = CONFIDENCE[:low]
        end
      else
        return
      end

      message = "Render path contains "

      case input.type
      when :params
        message << "parameter value"
      when :cookies
        message << "cookie value"
      when :request
        message << "request value"
      when :model
        #Skip models
        return
      else
        message << "user input value"
      end


      warn :result => result,
        :warning_type => "Dynamic Render Path",
        :message => message,
        :user_input => input.match,
        :confidence => confidence
    end
  end
end 
<commit_msg>[CSC] Only check render nodes in CheckRender<commit_after>require 'brakeman/checks/base_check'

#Check calls to +render()+ for dangerous values
class Brakeman::CheckRender < Brakeman::BaseCheck
  Brakeman::Checks.add self

  @description = "Finds calls to render that might allow file access"

  def run_check
    tracker.find_call(:target => nil, :method => :render).each do |result|
      process_render result
    end
  end

  def process_render result
    return unless node_type? result, :render

    case result[:call].render_type
    when :partial, :template, :action, :file
      check_for_dynamic_path result
    when :inline
    when :js
    when :json
    when :text
    when :update
    when :xml
    end
  end

  #Check if path to action or file is determined dynamically
  def check_for_dynamic_path result
    view = result[:call][2]

    if sexp? view and not duplicate? result
      add_result result


      if input = has_immediate_user_input?(view)
        confidence = CONFIDENCE[:high]
      elsif input = include_user_input?(view)
        if node_type? view, :string_interp, :dstr
          confidence = CONFIDENCE[:med]
        else
          confidence = CONFIDENCE[:low]
        end
      else
        return
      end

      message = "Render path contains "

      case input.type
      when :params
        message << "parameter value"
      when :cookies
        message << "cookie value"
      when :request
        message << "request value"
      when :model
        #Skip models
        return
      else
        message << "user input value"
      end


      warn :result => result,
        :warning_type => "Dynamic Render Path",
        :message => message,
        :user_input => input.match,
        :confidence => confidence
    end
  end
end 

{'fraction_non_alphanumeric': 0.07930146006298311, 'fraction_numerical': 0.000572573718866304, 'mean_word_length': 2.3823814133591483, 'pattern_counts': {'":': 0, '<': 21, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '229980', 'n_tokens_mistral': 1012, 'n_tokens_neox': 986, 'n_words': 323}