presidentbeef/brakeman — pull request #218 by presidentbeef (2012-12-20 22:43:49+00:00)
Title: Add optional simple helper method scanning for controllers

As a first step towards some "interprocedural" analysis, these changes add analysis of method calls in controllers to methods available in the controller.

With controller code like this:

```ruby
def some_action
do_something
end

def do_something
@some_value = params[:haxss]
end
```

And a view like this:

```erb
<%= raw @some_value %>
```

Brakeman will see

```erb
<%= raw params[:haxss]%>
```

This is only "depth 1", meaning it will not follow method calls inside methods other than the original controller method. I.e., if `do_something` called another method, that method would not be analyzed.

I've named this option `--interprocedural`, but it should probably have a better name.