guard / guard-brakeman

Guard::Brakeman allows you to automatically run Brakeman tests when files are modified.

Guard

Guard automates various tasks by running custom rules whenever file or directories are modified.

It's frequently used by software developers, web designers, writers and other specialists to avoid mundane, repetitive actions and commands such as "relaunching" tools after changing source files or configurations.

Common use cases include: an IDE replacement, web development tools, designing "smart" and "responsive" build systems/workflows, automating various project tasks and installing/monitoring various system services.

For a full categorized list of known Guard plugins, look here: https://github.com/guard/guard/wiki/Guard-Plugins

If you have any questions about Guard or want to share some information with the Guard community, please go to one of the following places:

• Guard Wiki
• Google group.
• StackOverflow.
• IRC channel #guard (irc.freenode.net) for chatting.

Before you file an issue, make sure you have read the known issues and file an issue sections that contains some important information.

Features

• File system changes handled by our awesome Listen gem.
• Support for visual system notifications.
• Huge eco-system with more than 300 Guard plugins.
• Tested against the latest Ruby 2.4.x, 2.5.x, 2.6.x, JRuby & Rubinius. See .travis-ci.yml for the exact versions.

Screencast

Two nice screencasts are available to help you get started:

• Guard on RailsCast.
• Guard is Your Best Friend on Net Tuts+.

Installation

The simplest way to install Guard is to use Bundler.

Add Guard (and any other dependencies) to a Gemfile in your project’s root:

group :development do
  gem 'guard'
end

then install it by running Bundler:

$ bundle

Generate an empty Guardfile with:

$ bundle exec guard init

Run Guard through Bundler with:

$ bundle exec guard

If you are on Mac OS X and have problems with either Guard not reacting to file changes or Pry behaving strange, then you should add proper Readline support to Ruby on macOS.

Avoiding gem/dependency problems

It's important that you always run Guard through Bundler to avoid errors.

If you're getting sick of typing bundle exec all the time, try one of the following:

• (Recommended) Running bundle binstub guard will create bin/guard in your project, which means running bin/guard (tab completion will save you a key stroke or two) will have the exact same result as bundle exec guard.

• Or, you can alias be="bundle exec" in your .bashrc or similar and the execute only be guard. Protip: It will work for all comands executed in bundle exec context!

• Or, for RubyGems >= 2.2.0 (at least, though the more recent the better), simply set the RUBYGEMS_GEMDEPS environment variable to - (for autodetecting the Gemfile in the current or parent directories) or set it to the path of your Gemfile.

(To upgrade RubyGems from RVM, use the rvm rubygems command).

NOTE: this Rubygems feature is still under development still lacks many features of bundler

• Or, for RubyGems < 2.2.0 check out the Rubygems Bundler.

Add Guard plugins

Guard is now ready to use and you should add some Guard plugins for your specific use. Start exploring the many Guard plugins available by browsing the Guard organization on GitHub or by searching for guard- on RubyGems.

When you have found a Guard plugin of your interest, add it to your Gemfile:

group :development do
  gem '<guard-plugin-name>'
end

See the init section of the Guard usage below to see how to install the supplied plugin template that you can install and to suit your needs.

Usage

Guard is run from the command line. Please open your terminal and go to your project work directory.

Look here for a full list of Guard commands

Start

Just launch Guard inside your Ruby or Rails project with:

$ bundle exec guard

Guard will look for a Guardfile or guardfile.rb in your current directory. If it does not find one, it will look in your $HOME directory for a .Guardfile.

Please look here to see all the command line options for Guard

Interactions

Please read how to interact with Guard on the console and which signals Guard accepts

Guardfile DSL

For details on extending your Guardfile look at Guardfile examples or look at a list of commands Guardfile-DSL / Configuring-Guard

Issues

Before reporting a problem, please read how to File an issue.

Development / Contributing

See the Contributing Guide.

Releasing

Prerequisites

• You must have commit rights to the GitHub repository.
• You must have push rights for rubygems.org.

How to release

1. Determine which would be the correct next version number according to semver.
2. Update the version in ./lib/guard/version.rb.
3. Commit the version in a single commit, the message should be "Bump VERSION to X.Y.Z".
4. Push and open a pull request.
5. Once CI is green, merge the pull request.
6. Pull the changes locally and run bundle exec rake release:full; this will tag, push to GitHub, publish to rubygems.org, and publish the release notes .

Author

Thibaud Guillaume-Gentil (@thibaudgg)

Core Team

• R.I.P. 💔 Michael Kessler.
• Rémy Coutable.
• Thibaud Guillaume-Gentil (@thibaudgg, thibaud.gg).

Contributors

https://github.com/guard/guard/graphs/contributors

guard-brakeman's Issues

Brakeman output is no longer formatted after PR#37

Since updating to the latest version, the brakeman output that is displayed when guard starts is no longer formatted / color coded.

See the following screenshot, which should be colored red. Instead only the key is displayed.

Is this a bug? Or a local setting?

Resolve 'run_on_change' deprecation warning

When running Guard 1.1.1 along with guard-brakeman the following deprecation warning is displayed:

DEPRECATION: Starting with Guard v1.1 the use of the 'run_on_change' method in the 'Guard::Brakeman' guard is deprecated.
Please consider replacing that method-call with 'run_on_changes' if the type of change
is not important for your usecase or using either 'run_on_modifications' or 'run_on_additions'
based on the type of the changes you want to handle.
For more information on how to update existing guards, please head over to:
https://github.com/guard/guard/wiki/Upgrade-guide-for-existing-guards-to-Guard-v1.1

Respect the config file

First of all thanks for the fine work. 👍

I have a simple config file (config/brakeman.yml) which contains the following:

---
:run_all_checks: true

When i run directly brakeman it works flawlessly, but guard seems to ignore it.
According to the README this paths should be tried for finding the config.

The default config locations are ./config/brakeman.yml, ~/.brakeman/config.yml, and /etc/brakeman/config.yml

Guard::Brakeman failed to achieve its <run_all>

Started getting this error since upgrading to guard 1.8.3, gist with backtrace here:

https://gist.github.com/jaredmoody/6984854

I'm not sure what changed in guard that's causing @tracker to be null during run_all, but adding @tracker ||= ::Brakeman::Scanner.new(@scanner_opts).process above line 58 seems to have fixed it for me, but probably isn't the right thing to do :P

brakeman report not adhering to confidence settings

I set min_confidence => 2. The guard-brakeman output is correct, but the report contains weak confidence items.

Hangs on Indexing call sites...

Just stays there without doing anything.

[Notice] Detected Rails 3 application
Processing configuration...
[Notice] Escaping HTML by default
Processing gems...
Processing initializers...
Processing libs...
Processing routes...          
Processing templates...       
Processing data flow in templates...
Processing models...          
Processing controllers...     
Processing data flow in controllers...
Indexing call sites...        

warning: already initialized constant REXML:: warnings with guard-brakeman

See: presidentbeef/brakeman#1705

I noticed that adding the guard-brakeman gem to my Gemfile (in the development group) causes lots of these warnings to appear in my logs:

/Users/ndbroadbent/.rbenv/versions/2.7.5/lib/ruby/gems/2.7.0/gems/brakeman-5.4.0/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb:30: warning: already initialized constant REXML::Parsers::BaseParser::LETTER
/Users/ndbroadbent/.rbenv/versions/2.7.5/lib/ruby/gems/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb:30: warning: previous definition of LETTER was here
/Users/ndbroadbent/.rbenv/versions/2.7.5/lib/ruby/gems/2.7.0/gems/brakeman-5.4.0/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb:31: warning: already initialized constant REXML::Parsers::BaseParser::DIGIT
/Users/ndbroadbent/.rbenv/versions/2.7.5/lib/ruby/gems/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb:31: warning: previous definition of DIGIT was here
/Users/ndbroadbent/.rbenv/versions/2.7.5/lib/ruby/gems/2.7.0/gems/brakeman-5.4.0/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb:33: warning: already initialized constant REXML::Parsers::BaseParser::COMBININGCHAR
/Users/ndbroadbent/.rbenv/versions/2.7.5/lib/ruby/gems/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb:33: warning: previous definition of COMBININGCHAR was here
/Users/ndbroadbent/.rbenv/versions/2.7.5/lib/ruby/gems/2.7.0/gems/brakeman-5.4.0/bundle/ruby/2.7.0/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb:34: warning: already initialized constant REXML::Parsers::BaseParser::EXTENDER
...

Different number of issues

When I run brakeman from the command line I get the following three issues:

Loading scanner...
[Notice] Detected Rails 3 application
Processing application in /Users/username/Development/foobar
Processing configuration...
[Notice] Escaping HTML by default
Processing gems...
Processing initializers...
Processing libs...
Processing routes...          
Processing templates...       
Processing data flow in templates...
Processing models...          
Processing controllers...     
Processing data flow in controllers...
Indexing call sites...        
Running checks in parallel...
 - CheckBasicAuth
 - CheckCrossSiteScripting
 - CheckContentTag
 - CheckDefaultRoutes
 - CheckDeserialize
 - CheckDigestDoS
 - CheckEscapeFunction
 - CheckEvaluation
 - CheckExecute
 - CheckFileAccess
 - CheckFilterSkipping
 - CheckForgerySetting
 - CheckJRubyXML
 - CheckJSONParsing
 - CheckLinkTo
 - CheckLinkToHref
 - CheckMailTo
 - CheckMassAssignment
 - CheckModelAttrAccessible
 - CheckModelAttributes
 - CheckModelSerialize
 - CheckNestedAttributes
 - CheckQuoteTableName
 - CheckRedirect
 - CheckRender
 - CheckResponseSplitting
 - CheckSafeBufferManipulation
 - CheckSanitizeMethods
 - CheckSelectTag
 - CheckSelectVulnerability
 - CheckSend
 - CheckSendFile
 - CheckSessionSettings
 - CheckSingleQuotes
 - CheckSkipBeforeFilter
 - CheckSQL
 - CheckStripTags
 - CheckSymbolDoS
 - CheckTranslateBug
 - CheckUnsafeReflection
 - CheckValidationRegex
 - CheckWithoutProtection
 - CheckYAMLParsing
Checks finished, collecting results...
Generating report...

+BRAKEMAN REPORT+

Application path: /Users/username/Development/foobar
Rails version: 3.2.12
Brakeman version: 2.1.0
Started at 2013-07-30 15:28:12 +0200
Duration: 0.61802 seconds
Checks run: BasicAuth, ContentTag, CrossSiteScripting, DefaultRoutes, Deserialize, DigestDoS, EscapeFunction, Evaluation, Execute, FileAccess, FilterSkipping, ForgerySetting, JRubyXML, JSONParsing, LinkTo, LinkToHref, MailTo, MassAssignment, ModelAttrAccessible, ModelAttributes, ModelSerialize, NestedAttributes, QuoteTableName, Redirect, Render, ResponseSplitting, SQL, SafeBufferManipulation, SanitizeMethods, SelectTag, SelectVulnerability, Send, SendFile, SessionSettings, SingleQuotes, SkipBeforeFilter, StripTags, SymbolDoS, TranslateBug, UnsafeReflection, ValidationRegex, WithoutProtection, YAMLParsing


+SUMMARY+

+-------------------+-------+
| Scanned/Reported  | Total |
+-------------------+-------+
| Controllers       | 8     |
| Models            | 9     |
| Templates         | 17    |
| Errors            | 0     |
| Security Warnings | 3 (1) |
+-------------------+-------+

+-------------------+-------+
| Warning Type      | Total |
+-------------------+-------+
| Denial of Service | 1     |
| Redirect          | 1     |
| Session Setting   | 1     |
+-------------------+-------+


+SECURITY WARNINGS+

+------------+-------------------------+--------+-------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------->>
| Confidence | Class                   | Method | Warning Type      | Message                                                                                                                                                             >>
+------------+-------------------------+--------+-------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------->>
| High       |                         |        | Session Setting   | Session secret should not be included in version control near line 7                                                                                                >>
| Medium     |                         |        | Denial of Service | Rails 3.2.12 has a denial of service vulnerability in ActiveRecord: upgrade to 3.2.13 or patch                                                                      >>
| Weak       | ResourceTypesController | create | Redirect          | Possible unprotected redirect near line 31: redirect_to(AuthorizationManager.begin(+params[:resource_type]+, authorization_callback_url, save_resource_url(current_u>>
+------------+-------------------------+--------+-------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------->>

… but when developing using guard with the following Guardfile portion:

guard 'brakeman', :run_on_start => true do
  watch(%r{^app/.+\.(erb|haml|rhtml|rb)$})
  watch(%r{^config/.+\.rb$})
  watch(%r{^lib/.+\.rb$})
  watch('Gemfile')
end

… I get:

 - CheckBasicAuth
 - CheckCrossSiteScripting
 - CheckContentTag
 - CheckDefaultRoutes
 - CheckDeserialize
 - CheckDigestDoS
 - CheckEscapeFunction
 - CheckEvaluation
 - CheckExecute
 - CheckFileAccess
 - CheckFilterSkipping
 - CheckForgerySetting
 - CheckJRubyXML
 - CheckJSONParsing
 - CheckLinkTo
 - CheckLinkToHref
 - CheckMailTo
 - CheckMassAssignment
 - CheckModelAttrAccessible
 - CheckModelAttributes
 - CheckModelSerialize
 - CheckNestedAttributes
 - CheckQuoteTableName
 - CheckRedirect
 - CheckRender
 - CheckResponseSplitting
 - CheckSafeBufferManipulation
 - CheckSanitizeMethods
 - CheckSelectTag
 - CheckSelectVulnerability
 - CheckSend
 - CheckSendFile
 - CheckSessionSettings
 - CheckSingleQuotes
 - CheckSkipBeforeFilter
 - CheckSQL
 - CheckStripTags
 - CheckSymbolDoS
 - CheckTranslateBug
 - CheckUnsafeReflection
 - CheckValidationRegex
 - CheckWithoutProtection
 - CheckYAMLParsing
Checks finished, collecting results...
15:30:30 - INFO - 
> [#A8B2169A468B] ------ brakeman warnings --------
> [#A8B2169A468B] 
15:30:30 - INFO - 2 brakeman findings
15:30:30 - INFO - High - Session Setting - Session secret should not be included in version control near line 7 in /config/initializers/secret_token.rb
15:30:30 - INFO - Medium - Denial of Service - Rails 3.2.12 has a denial of service vulnerability in ActiveRecord: upgrade to 3.2.13 or patch in /Gemfile

Any ideas?

url_safe_methods

This is very useful thank you.

When running brakeman from the command line, I can specify which url methods are safe using the url_safe_methods parameter. Can I do this with guard-brakeman?

Chris

License missing from gemspec

RubyGems.org doesn't report a license for your gem. This is because it is not specified in the gemspec of your last release.

via e.g.

spec.license = 'MIT'
# or
spec.licenses = ['MIT', 'GPL-2']

Including a license in your gemspec is an easy way for rubygems.org and other tools to check how your gem is licensed. As you can image, scanning your repository for a LICENSE file or parsing the README, and then attempting to identify the license or licenses is much more difficult and more error prone. So, even for projects that already specify a license, including a license in your gemspec is a good practice. See, for example, how rubygems.org uses the gemspec to display the rails gem license.

There is even a License Finder gem to help companies/individuals ensure all gems they use meet their licensing needs. This tool depends on license information being available in the gemspec. This is an important enough issue that even Bundler now generates gems with a default 'MIT' license.

I hope you'll consider specifying a license in your gemspec. If not, please just close the issue with a nice message. In either case, I'll follow up. Thanks for your time!

Appendix:

If you need help choosing a license (sorry, I haven't checked your readme or looked for a license file), GitHub has created a license picker tool. Code without a license specified defaults to 'All rights reserved'-- denying others all rights to use of the code.
Here's a list of the license names I've found and their frequencies

p.s. In case you're wondering how I found you and why I made this issue, it's because I'm collecting stats on gems (I was originally looking for download data) and decided to collect license metadata,too, and make issues for gemspecs not specifying a license as a public service :). See the previous link or my blog post aobut this project for more information.

:min_confidence not respected

running brakeman -w3 gives me no warnings but guard 'brakeman', :min_confidence => 3 gives me all the errors of just running brakeman

TypeError: nil is not a symbol when output_file is set

Guardfile:

guard 'brakeman', :output_file => 'output.html' do
  watch(%r{^app/.+\.(erb|haml|rhtml|rb)$})
  watch(%r{^config/.+\.rb$})
  watch(%r{^lib/.+\.rb$})
  watch('Gemfile')
end

When I run guard then I get the following error:

ERROR: Guard::Brakeman failed to achieve its , exception was:
TypeError: nil is not a symbol
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-brakeman-0.3.2/lib/guard/brakeman.rb:160:in `block in write_report'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-brakeman-0.3.2/lib/guard/brakeman.rb:158:in `open'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-brakeman-0.3.2/lib/guard/brakeman.rb:158:in `write_report'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-brakeman-0.3.2/lib/guard/brakeman.rb:89:in `print_failed'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-brakeman-0.3.2/lib/guard/brakeman.rb:57:in `run_all'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:387:in `block in run_supervised_task'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:385:in `catch'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:385:in `run_supervised_task'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:256:in `block (2 levels) in run_all'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:319:in `block (3 levels) in run_on_guards'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:318:in `each'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:318:in `block (2 levels) in run_on_guards'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:317:in `catch'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:317:in `block in run_on_guards'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:316:in `each'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:316:in `run_on_guards'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:255:in `block in run_all'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:295:in `block in run'
:10:in `synchronize'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:292:in `run'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard.rb:254:in `run_all'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard/interactor.rb:132:in `process_input'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard/interactors/simple.rb:12:in `read_line'
/Users/mpouleijn/.rvm/gems/ruby-1.9.3-head@shop/gems/guard-1.0.1/lib/guard/interactor.rb:93:in `block in start'

Using another formatter

How would I go about outputing brakeman into html file? The text output is almost unreadable. Is this supported via guard block options, or is this not implemented?

In vanilla brakeman, I would use

 brakeman -f output.html

Make guard-brakeman intelligent enough to handle output_file[s]? correctly

Version 1.5.2 changed the command line flag's corresponding option key from output_file to output_files. Guard-brakeman should be smart enough to handle either case both going forwards and backwards. Or just not support anything before 1.5.3 :P

Figure out why there is no traction of this project

We've only had about 5 people get involved and hardly any bug reports. The code is kinda crappy (SRP what?) and I haven't put much effort into it, but I'm not seeing significant issues being filed.

So...

1. It's useless, no need
2. It sucks, is detrimental to my workflow
3. Is buggy, doesn't really work (works for me!)
4. Doesn't work the way I want it to (there is one open issue about this)

Any feedback would be great. Dead silence for the most part.

1.8.x dependency bump

guard-brakeman now requires ~> 1.7.0, can we get an update to ~> 1.8.x?

support brakeman 2.1.1 ignore files

Brakeman can now ignore warnings based on a brakeman.ignore file in the config directory.

As far as I can tell, the ignore file is not being used while guard-brakeman runs. Presently I have some brakeman warnings I know to be false-positives, so they're safe to ignore. I'd rather not see them repeatedly in the guard notifications if possible.