presidentbeef/brakeman — pull request #345 by presidentbeef (2013-06-07 23:53:06+00:00)
Title: Limit branched value depth

When dealing with branches, Brakeman generates basically "union" values of possible values for a given variable. (See one of the many other issues dealing with this for more info, like #297).

In some situations (lots of assignments to the same variable inside different branches), however, these values can grow to be unreasonably large. In most _useful_ cases, the values aren't that large.

This change introduces a limit on these union values. The default is `5`, which means a given variable should only have five alternative values. If a sixth alternative is encountered (i.e. assignment inside another branch), the old values get kicked out, the new value is saved and the process starts over. This seems like a decent compromise between being flow insensitive (like `--no-branching`) and the current state of affairs (track everything, causing massive slowdowns and memory usage).

To turn off the limiting, use `--branch-limit -1`.

`--branch-limit 0` is almost like `--no-branching` except slower because it's still trying to track stuff.

In testing, a value of `5` did not show any difference in detected vulnerabilities, although it is entirely possible (though empirical evidence points towards unlikely) that some vulnerabilities would be hidden because of this.