Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False positive when methods chained on permitted params #1885

Open
bschmeck opened this issue Nov 20, 2024 · 0 comments
Open

False positive when methods chained on permitted params #1885

bschmeck opened this issue Nov 20, 2024 · 0 comments

Comments

@bschmeck
Copy link

Background

Brakeman version: 6.2.2
Rails version: 8.0.0
Ruby version: 3.3.5

False Positive

Full warning from Brakeman:

Confidence: High
Category: SQL Injection
Check: SQL
Message: Possible SQL injection
Code: MyModel.where(params.permit(:foo, :bar).slice(:foo, :bar).compact_blank)

Relevant code:

MyModel.where(params.permit(:foo, :bar).slice(:foo, :bar)) # no warning
MyModel.where(params.permit(:foo, :bar).slice(:foo, :bar).compact_blank) # warning

The compact_blank method returns a new ActionController::Parameters object, but that new object retains the permitted status from our earlier call to permit. There is a list of permitted method calls defined here but compact_blank is not listed there. It probably shouldn't be, because compact_blank on its own does not make the call safe, but being chained after permit ought to.

Is there a way to mark methods that are chained after permit as safe?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant