presidentbeef/brakeman — pull request #133 by presidentbeef (2012-08-24 18:40:45+00:00)
Title: Track render chain for templates

Currently, templates only track where they were rendered from. This works fine for views which are rendered from controller actions, because the combination of "controller action + template" is unique. However, for any partials rendered from templates, the combination of "template + partial" may occur multiple times. This caused "shadowing" of partials where a partial might be rendered several times, possibly with different input, but only a single rendered version would be scanned.

This patch fixes that problem by tracking the entire "render chain" for each template/partial, from the controller down. Right now, the render chain is only shown in the HTML report.

This patch also fixes an unrelated problem (but one that had to be fixed for tests to pass). Warnings caused by calls to `raw` would sometimes be duplicated due to flawed logic. The weird aspect was that one warning would be "high" confidence and the other would be "weak". Anyway, fixed.