diff --git a/Gemfile b/Gemfile index 5040f8f..0353fc3 100644 --- a/Gemfile +++ b/Gemfile @@ -45,9 +45,9 @@ end group :development do gem 'annotaterb', '~> 4.22', require: false gem 'brakeman', '~> 8.0.4', require: false - gem 'rubocop', '~> 1.86.1', require: false + gem 'rubocop', '~> 1.86.2', require: false gem 'rubocop-minitest', '~> 0.39.1', require: false - gem 'rubocop-rails', '~> 2.34', require: false + gem 'rubocop-rails', '~> 2.35', require: false gem 'web-console', '~> 4.3.0' end diff --git a/Gemfile.lock b/Gemfile.lock index 30de776..72eb33d 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -82,7 +82,7 @@ GEM activesupport (>= 6.0.0) ast (2.4.3) base64 (0.3.0) - bigdecimal (4.1.1) + bigdecimal (4.1.2) bindex (0.8.1) bootsnap (1.24.4) msgpack (~> 1.2) @@ -151,7 +151,7 @@ GEM prism (>= 1.3.0) rdoc (>= 4.0.0) reline (>= 0.4.2) - json (2.19.3) + json (2.19.5) jwt (2.10.2) base64 language_server-protocol (3.17.0.5) @@ -169,7 +169,7 @@ GEM marcel (1.1.0) matrix (0.4.3) mini_mime (1.1.5) - minitest (6.0.4) + minitest (6.0.6) drb (~> 2.0) prism (~> 1.5) msgpack (1.8.0) @@ -209,7 +209,7 @@ GEM multi_json (~> 1.3) multi_xml (~> 0.5) rack (>= 1.2, < 4) - parallel (2.0.1) + parallel (2.1.0) parser (3.3.11.1) ast (~> 2.4.1) racc @@ -287,7 +287,7 @@ GEM reline (0.6.3) io-console (~> 0.5) rexml (3.4.4) - rubocop (1.86.1) + rubocop (1.86.2) json (~> 2.3) language_server-protocol (~> 3.17.0.2) lint_roller (~> 1.1.0) @@ -305,7 +305,7 @@ GEM lint_roller (~> 1.1) rubocop (>= 1.75.0, < 2.0) rubocop-ast (>= 1.38.0, < 2.0) - rubocop-rails (2.34.3) + rubocop-rails (2.35.0) activesupport (>= 4.2.0) lint_roller (~> 1.1) rack (>= 1.1) @@ -384,9 +384,9 @@ DEPENDENCIES puma (~> 8.0) rack-cors (~> 3.0.0) rails (~> 8.1.3) - rubocop (~> 1.86.1) + rubocop (~> 1.86.2) rubocop-minitest (~> 0.39.1) - rubocop-rails (~> 2.34) + rubocop-rails (~> 2.35) rugged (~> 1.9.0) selenium-webdriver (~> 4.44.0) sentry-rails (~> 6.5.0) diff --git a/app/controllers/coders_controller.rb b/app/controllers/coders_controller.rb index 043055e..f37ba4b 100644 --- a/app/controllers/coders_controller.rb +++ b/app/controllers/coders_controller.rb @@ -10,7 +10,7 @@ def show .extending(CommitStats) .with_commit_stats .with_repository_count - .find(params[:id]) + .find(params.expect(:id)) @sort_column = params[:order_by] @sort_column = 'score' unless %w[score commit_count additions deletions].include?(@sort_column) diff --git a/app/controllers/repositories_controller.rb b/app/controllers/repositories_controller.rb index 9bef3c2..529c276 100644 --- a/app/controllers/repositories_controller.rb +++ b/app/controllers/repositories_controller.rb @@ -6,7 +6,7 @@ def index end def show - @repository = Repository.find(params[:id]) + @repository = Repository.find(params.expect(:id)) @sort_column = params[:order_by] @sort_column = 'score' unless %w[score commit_count additions deletions].include?(@sort_column) diff --git a/config/brakeman.ignore b/config/brakeman.ignore index f754e53..5528ec6 100644 --- a/config/brakeman.ignore +++ b/config/brakeman.ignore @@ -3,31 +3,31 @@ { "warning_type": "Cross-Site Scripting", "warning_code": 4, - "fingerprint": "881846274e4d7b75335f573d5eab757d51c5c90eef294832cc09cfd5cef66a76", + "fingerprint": "065b89873086865cc6f76d578cb34902cb52cfb6d5b6a1c2d8332e3b2127d76e", "check_name": "LinkToHref", "message": "Potentially unsafe model attribute in `link_to` href", - "file": "app/views/repositories/show.html.erb", - "line": 4, + "file": "app/views/coders/show.html.erb", + "line": 13, "link": "https://brakemanscanner.org/docs/warning_types/link_to_href", - "code": "link_to(image_tag(\"github.svg\", :class => \"image invert is-32x32 ml-2\"), Repository.find(params[:id]).github_url, :title => \"View repository on Github\")", + "code": "link_to(image_tag(\"github.svg\", :class => \"image invert is-32x32 ml-2\"), Coder.in_organisation.extending(CommitStats).with_commit_stats.with_repository_count.find(params.expect(:id)).github_url, :title => \"View profile on Github\")", "render_path": [ { "type": "controller", - "class": "RepositoriesController", + "class": "CodersController", "method": "show", - "line": 14, - "file": "app/controllers/repositories_controller.rb", + "line": 18, + "file": "app/controllers/coders_controller.rb", "rendered": { - "name": "repositories/show", - "file": "app/views/repositories/show.html.erb" + "name": "coders/show", + "file": "app/views/coders/show.html.erb" } } ], "location": { "type": "template", - "template": "repositories/show" + "template": "coders/show" }, - "user_input": "Repository.find(params[:id]).github_url", + "user_input": "Coder.in_organisation.extending(CommitStats).with_commit_stats.with_repository_count.find(params.expect(:id)).github_url", "confidence": "Weak", "cwe_id": [ 79 @@ -37,31 +37,31 @@ { "warning_type": "Cross-Site Scripting", "warning_code": 4, - "fingerprint": "dd714f14376692d3d409b49cad136fbe1d8205036f4a9f917679d296899249b4", + "fingerprint": "b592b4615e92cc62c9f3f90f52ebeba50d875b87f5b683d32603d593a9ed1134", "check_name": "LinkToHref", "message": "Potentially unsafe model attribute in `link_to` href", - "file": "app/views/coders/show.html.erb", - "line": 13, + "file": "app/views/repositories/show.html.erb", + "line": 4, "link": "https://brakemanscanner.org/docs/warning_types/link_to_href", - "code": "link_to(image_tag(\"github.svg\", :class => \"image invert is-32x32 ml-2\"), Coder.in_organisation.extending(CommitStats).with_commit_stats.with_repository_count.find(params[:id]).github_url, :title => \"View profile on Github\")", + "code": "link_to(image_tag(\"github.svg\", :class => \"image invert is-32x32 ml-2\"), Repository.find(params.expect(:id)).github_url, :title => \"View repository on Github\")", "render_path": [ { "type": "controller", - "class": "CodersController", + "class": "RepositoriesController", "method": "show", - "line": 18, - "file": "app/controllers/coders_controller.rb", + "line": 14, + "file": "app/controllers/repositories_controller.rb", "rendered": { - "name": "coders/show", - "file": "app/views/coders/show.html.erb" + "name": "repositories/show", + "file": "app/views/repositories/show.html.erb" } } ], "location": { "type": "template", - "template": "coders/show" + "template": "repositories/show" }, - "user_input": "Coder.in_organisation.extending(CommitStats).with_commit_stats.with_repository_count.find(params[:id]).github_url", + "user_input": "Repository.find(params.expect(:id)).github_url", "confidence": "Weak", "cwe_id": [ 79 @@ -69,5 +69,5 @@ "note": "This URL comes from GitHub, not from user input" } ], - "brakeman_version": "7.1.0" + "brakeman_version": "8.0.4" }