presidentbeef/brakeman — pull request #253 by presidentbeef (2013-02-04 21:04:35+00:00)
Title: Check for ActiveRecord::Relation#update all

`update_all` accepts straight SQL in addition to the usual conditions-style parameterized queries. For even more fun, it sends the SQL straight to the database, bypassing any validators.

`CheckSQL` should now detect SQL injection in `update_all` like it does in other ActiveRecord calls.