diff --git a/lib/brakeman/processors/alias_processor.rb b/lib/brakeman/processors/alias_processor.rb index 87a7696aad..188421be29 100644 --- a/lib/brakeman/processors/alias_processor.rb +++ b/lib/brakeman/processors/alias_processor.rb @@ -703,7 +703,30 @@ def process_hash exp end end - exp + # Return early unless there might be short-hand syntax, + # since handling it is kind of expensive. + return exp unless exp.any? { |e| e.nil? } + + # Need to handle short-hand hash syntax + new_hash = [:hash] + hash_iterate(exp) do |key, value| + # e.g. { a: } + if value.nil? and symbol? key + # Only handling local variables for now, not calls + lvar = s(:lvar, key.value) + if var_value = env[lvar] + new_hash << key << var_value.deep_clone(key.line || 0) + else + # If the value is unknown, assume it was a call + # and set the value to a call + new_hash.concat << key << s(:call, nil, key.value).line(key.line || 0) + end + else + new_hash.concat << key << value + end + end + + Sexp.from_array(new_hash).line(exp.line || 0) end #Merge values into hash when processing diff --git a/test/tests/alias_processor.rb b/test/tests/alias_processor.rb index e2b885116f..47818d60d0 100644 --- a/test/tests/alias_processor.rb +++ b/test/tests/alias_processor.rb @@ -294,6 +294,30 @@ def test_hash_double_splat RUBY end + def test_hash_shorthand_syntax + assert_alias '2', <<-RUBY + a = 1 + b = 2 + h = { a:, b: } + h[:b] + RUBY + end + + def test_hash_shorthand_syntax_unknown_value + assert_alias 'b', <<-RUBY + h = { a:, b:, c: 1 } + h[:b] + RUBY + end + + def test_hash_shorthand_syntax_mix + assert_alias '3', <<-RUBY + a = 1 + h = { a:, b:, c: 3 } + h[:c] + RUBY + end + def test_splat_array_args assert_alias 'x(1, b, :c)', <<-RUBY a = b