presidentbeef/brakeman — pull request #58 by presidentbeef (2012-03-20 23:47:56+00:00)
Title: Improved dynamic render check

The current "dynamic render path" check is really lame.

This patch changes it to only warn when user input is actually used in the render path. It currently does *not* warn on models/model attributes.

It only reports with high confidence if user input is used directly (like `render :action => params[:action]`), weak confidence otherwise. I'm kind of on the fence here, though - should those be a medium warning instead of weak?

This patch also changes `Brakeman::BaseCheck#has_user_input?` to ignore user input in the conditions of `if` statements. This should get rid of those warnings on things like `<%= @user.whatever? ? 'totally_innocent' : 'just a string' %>`.