github/brakeman — pull request #10 by ptoomey3 (2014-04-09 13:50:33+00:00)
Title: Process inner body on method defs

@mastahyeti - This was what I was trying to remember when you submitted https://github.com/github/brakeman/pull/5. Without this patch I don't see brakeman able to detect interpolated strings with the `include_interp?` helper that is built-in when parsing the `lib` directory. This is what made me think each processor was in charge of it's own processing. But, I now think this might just be a side effect of how brakeman detects/annotates the s-expression when it dealing with interpolated strings specifically. Unlike simple method defs/uses (which work fine inside `lib`), interpolated strings are detected by ensuring that the s-expression contains a custom node type that brakeman itself specifically adds to the s-expression. This is all a bit hand wavy..and I'm a bit unclear why default processing doesn't end up adding the annotation...but I think that is roughly right. So, I think we need to ensure the inner expression is explicitly processed so that interpolated strings are processed correctly. If you have a deeper sense of why this is needed please do share :smile:...I'm still trying to fully grok the whole pipeline.

I stole the inner s-expression processing idiom from https://github.com/github/brakeman/blob/master/lib/brakeman/processors/controller_processor.rb#L73.

/cc @mastahyeti @gregose