CheckSQL: Test for params in method arguments

test/apps/rails3.1/app/models/product.rb

@@ -100,6 +100,13 @@ class Product < ActiveRecord::Base
     #Should not warn
     Product.last("blah = '#{params[:blah] ? 1 : 0}'")
   end
+
+  def test_params_in_args
+    #Should warn
+    Product.last("blah = '#{something(params[:blah])}'")
+  end
+
+
   def test_more_if_statements
     if some_condition
       x = params[:x]
@@ -121,4 +128,5 @@ class Product < ActiveRecord::Base
     #Should not warn
     Product.last("blah = '#{y}'")
     Product.where("blah = 1").group(y)
+  end
 end

test/tests/test_rails31.rb

@@ -288,6 +288,15 @@ class Rails31Tests < Test::Unit::TestCase
       :file => /product\.rb/
   end
 
+  def test_sql_injection_in_method_args
+    assert_warning :type => :warning,
+      :warning_type => "SQL Injection",
+      :line => 106,
+      :message => /^Possible\ SQL\ injection/,
+      :confidence => 0,
+      :file => /product\.rb/
+  end
+
   def test_sql_injection_with_if_statements
     assert_warning :type => :warning,
       :warning_type => "SQL Injection",