presidentbeef/brakeman — pull request #113 by presidentbeef (2012-07-12 03:12:05+00:00)
Title: Improve file access check with better confidence levels

I may have misinterpreted #106, but it still led me to improve CheckFileAccess.

Previously, if any user input was detected in a file name, then Brakeman reported a high confidence warning. This commit brings CheckFileAccess a little more in line with how the other checks work, with varying confidence warnings.

High confidence for user input directly in the file name:

```ruby
File.read params[:file]
```

or interpolated into a string:

```
File.read "/tmp/#{params[:file]}"
```

Medium confidence for model attributes directly in file name:

```ruby
File.read User.find(params[:id]).cool_file_path
```

Low confidence for indirect input:

```ruby
File.read blah(cookies[:file])
```

This change also supports ignoring indirect input with the `--report-direct` option.