presidentbeef/brakeman — pull request #296 by HonoreDB (2013-03-20 21:51:02+00:00)
Title: Add check for unsafe symbol creation

Closes https://github.com/presidentbeef/brakeman/issues/293.

As suggested, I modified the parser so that it considers `:"foo_#{bar}_#{baz}"` to be a method call with `"foo"`, `bar`, and `baz` as arguments. To test I added both this form and `to_sym` to the Rails2 app, and checked that there was a warning for each error. Two additional (legitimate) warnings are generated by other code calling `to_sym` on user data.

Tested with ruby-1.8.7-p358 and ruby-1.9.3-p194.