From c2b5c42368310e21247b0c54f3bb9ed555292968 Mon Sep 17 00:00:00 2001
From: Vipul A M <vipulnsward@gmail.com>
Date: Sun, 31 Dec 2023 11:33:35 -0600
Subject: [PATCH] Add brakeman to new Rails applications

It can be skipped with the `--skip-brakeman` flag.

Closes #50501
---
 railties/CHANGELOG.md                         |  4 ++++
 railties/lib/rails/generators/app_base.rb     |  6 +++++
 .../generators/rails/app/app_generator.rb     |  7 ++++--
 .../generators/rails/app/templates/Gemfile.tt |  5 +++++
 .../rails/app/templates/bin/brakeman.tt       |  4 ++++
 .../test/generators/app_generator_test.rb     | 22 +++++++++++++++++++
 6 files changed, 46 insertions(+), 2 deletions(-)
 create mode 100644 railties/lib/rails/generators/rails/app/templates/bin/brakeman.tt

diff --git a/railties/CHANGELOG.md b/railties/CHANGELOG.md
index 2fcd6359a65d1..250677233754c 100644
--- a/railties/CHANGELOG.md
+++ b/railties/CHANGELOG.md
@@ -1,3 +1,7 @@
+*   Add brakeman gem by default for static analysis of security vulnerabilities. Allow skipping with --skip-brakeman option.
+
+    *vipulnsward*
+
 *   Add RuboCop with rules from rubocop-rails-omakase by default. Skip with --skip-rubocop.
 
     *DHH* and *zzak*
diff --git a/railties/lib/rails/generators/app_base.rb b/railties/lib/rails/generators/app_base.rb
index e4e14406d6fe1..ef2ca10aacbed 100644
--- a/railties/lib/rails/generators/app_base.rb
+++ b/railties/lib/rails/generators/app_base.rb
@@ -103,6 +103,9 @@ def self.add_shared_options_for(name)
         class_option :skip_rubocop,        type: :boolean, default: nil,
                                            desc: "Skip RuboCop setup"
 
+        class_option :skip_brakeman,       type: :boolean, default: nil,
+                                           desc: "Skip brakeman setup"
+
         class_option :dev,                 type: :boolean, default: nil,
                                            desc: "Set up the #{name} with Gemfile pointing to your Rails checkout"
 
@@ -386,6 +389,9 @@ def skip_rubocop?
         options[:skip_rubocop]
       end
 
+      def skip_brakeman?
+        options[:skip_brakeman]
+      end
 
       class GemfileEntry < Struct.new(:name, :version, :comment, :options, :commented_out)
         def initialize(name, version, comment, options = {}, commented_out = false)
diff --git a/railties/lib/rails/generators/rails/app/app_generator.rb b/railties/lib/rails/generators/rails/app/app_generator.rb
index 977a7e8d5db0a..6e276226d2305 100644
--- a/railties/lib/rails/generators/rails/app/app_generator.rb
+++ b/railties/lib/rails/generators/rails/app/app_generator.rb
@@ -102,8 +102,11 @@ def app
     end
 
     def bin
-      options = skip_rubocop? ? { exclude_pattern: /rubocop/ } : {}
-      directory "bin", **options do |content|
+      patterns = []
+      patterns << /rubocop/ if skip_rubocop?
+      patterns << /brakeman/ if skip_brakeman?
+      exclude_pattern = Regexp.union(patterns)
+      directory "bin", { exclude_pattern: } do |content|
         "#{shebang}\n" + content
       end
       chmod "bin", 0755 & ~File.umask, verbose: false
diff --git a/railties/lib/rails/generators/rails/app/templates/Gemfile.tt b/railties/lib/rails/generators/rails/app/templates/Gemfile.tt
index fe5bc553c5519..f3e195d7bea9b 100644
--- a/railties/lib/rails/generators/rails/app/templates/Gemfile.tt
+++ b/railties/lib/rails/generators/rails/app/templates/Gemfile.tt
@@ -40,6 +40,11 @@ end
 <% end -%>
 
 group :development do
+<%- unless options.skip_brakeman? -%>
+  # Static analysis for security vulnerabilities [https://brakemanscanner.org/]
+  gem "brakeman", require: false
+
+<%- end -%>
 <%- unless options.skip_rubocop? -%>
   # Omakase Ruby styling [https://github.com/rails/rubocop-rails-omakase/]
   gem "rubocop-rails-omakase", require: false
diff --git a/railties/lib/rails/generators/rails/app/templates/bin/brakeman.tt b/railties/lib/rails/generators/rails/app/templates/bin/brakeman.tt
new file mode 100644
index 0000000000000..a993625e04e15
--- /dev/null
+++ b/railties/lib/rails/generators/rails/app/templates/bin/brakeman.tt
@@ -0,0 +1,4 @@
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("brakeman", "brakeman")
diff --git a/railties/test/generators/app_generator_test.rb b/railties/test/generators/app_generator_test.rb
index ebaeccd7aa75a..5967611b5095f 100644
--- a/railties/test/generators/app_generator_test.rb
+++ b/railties/test/generators/app_generator_test.rb
@@ -38,6 +38,7 @@
   app/views/layouts/mailer.html.erb
   app/views/layouts/mailer.text.erb
   bin/docker-entrypoint
+  bin/brakeman
   bin/rails
   bin/rake
   bin/rubocop
@@ -638,6 +639,27 @@ def test_rubocop_is_skipped_if_required
     assert_no_file ".rubocop.yml"
   end
 
+  def test_inclusion_of_brakeman
+    run_generator
+    assert_gem "brakeman"
+  end
+
+  def test_brakeman_is_skipped_if_required
+    puts destination_root
+    run_generator [destination_root, "--skip-brakeman"]
+
+    assert_no_gem "brakeman"
+    assert_no_file "bin/brakeman"
+  end
+
+  def test_both_brakeman_and_rubocop_binstubs_are_skipped_if_required
+    puts destination_root
+    run_generator [destination_root, "--skip-brakeman", "--skip-rubocop"]
+
+    assert_no_file "bin/rubocop"
+    assert_no_file "bin/brakeman"
+  end
+
   def test_usage_read_from_file
     assert_called(File, :read, returns: "USAGE FROM FILE") do
       assert_equal "USAGE FROM FILE", Rails::Generators::AppGenerator.desc