presidentbeef/brakeman — Issue #32: Don't warn for XSS on literals
Author: oreoshake
Created: 2012-01-18 04:32:50+00:00
State: open

{"Confidence"=>0, "Warning Type"=>"Cross Site Scripting", "Message"=>"Unescaped model attribute in link_to near line 9: link_to((Unresolved Model).new.action_str, \"#\", :class => \"action rpprelmodal\")", "Class"=>"", "Method"=>""}

I believe the warning came from the \"#\" not being html safe. But it is a literal, and I think it's a reasonable assumption that literals are safe?

Devil's advocate: programmers can put malicious scripts directly into the app.