Repository: presidentbeef/brakeman

Issue #1529: Renderables dynamic render path false positive
Created: 2020-11-13T00:43:45Z
Firstly, thanks so much for this tool. We're (Five Good Friends) grateful to have something like this to help us make sure we're doing all we can to keep the people who use our software safe :).
Background
Brakeman version: 4.10
Rails version: 6.0.3.4
Ruby version: 2.6.6
Link to Rails application code: Sorry, closed-source. But I've added a failing spec in a Brakeman fork
False Positive
Full warning from Brakeman:
{
  "warning_type": "Dynamic Render Path",
  "warning_code": 15,
  "fingerprint": "9485294198b3a144dd293dc9f26cc7653da664e5e6d79d15fcac79750a4b0228",
  "check_name": "Render",
  "message": "Render path contains parameter value",
  "file": "/Users/brad.parker/Code/presidentbeef/brakeman/test/apps/rails6/app/controllers/groups_controller.rb",
  "line": 12,
  "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
  "code": "render(action => TestRenderer.new(params.require(\"name\")), {})",
  "render_path": null,
  "location": {
    "type": "method",
    "class": "GroupsController",
    "method": "render_commands"
  },
  "user_input": "params.require(\"name\")",
  "confidence": "Weak"
}
Relevant code:
def render_commands
  render(TestRenderer.new(params.require('name')))
end
Why might this be a false positive?
Rails 6.1 now supports passing Renderables to render. We've started using Github's ViewComponent gem which makes use of this new Rails feature.
I'm not sure what changes could be made to CheckRender but I'd be happy to take a swing at it with some pointers. It seems like there might be a way to add something similar to the input.type == :model check, is this on the right track?
Thanks again :)

Duplicate issue #1616: False positive when using ViewComponent
Created: 2021-06-28T13:59:28Z
Background
Brakeman version: 5.0.2
Rails version: 6.1.3.2
Ruby version: 2.7.3
False Positive
Full warning from Brakeman:
Confidence: Weak
Category: Dynamic Render Path
Check: Render
Message: Render path contains parameter value
Code: render(action => SomeComponent.new(:foo => params[:foo])
File: app/views/something.html.slim
Line: 1

(I've anonymized the code here, but this should be functionally equivalent to my code)
Relevant code:
  = render SomeComponent.new(foo: params[:foo])
Why might this be a false positive?
I believe what's going on here is Brakeman is throwing an error because we have a params somewhere inside a call to render. That may have been a good check before, but it is no longer a good check now that we're using ViewComponent.
If I understand correctly, brakeman's goal with this check is to avoid things like render "templates/#{params[:some_user_input]}", because then users could access templates they’re not supposed to. But in this case, we’re not doing that. We’re specifying the "template" via hard-coding a VC component, and it just so happens to need a param as an input.
More generally, I think this will happen more often because Rails' render method was updated to support rendering any class that responds to render_in.

Closing comment (2021-07-02T13:10:25Z): Hi @dkniffin it seems your issue is a duplicate of #1529 which was fixed in #1578. This isn't released yet as a new RubyGems release, but you can try it out by using the main branch of this repo (e.g. gem 'brakeman', '~> 5.0', github: 'presidentbeef/brakeman', branch: 'main'). Could you try if this fixes your issue?
Ps. I ran into your issue because of slightly different problem (false positive) when render is used to render a collection of or single ActiveRecord object, e.g. render User.where(id: params[:ids]).all or render User.find(params[:id]). Rails supports this, by automatically rendering the _user partial for each/this object. However Brakeman gives a false warning for this, because it thinks user input is used in determining the path of the partial. There are several open issues about this (#959, #529, #1441). Unfortunately this isn't fixed as well by #1578 (I tried), but maybe it can be fixed using a similar solution.