提交 bbcdc7fc 编写于 作者: J Justin Collins

CheckSQL: Ignore sanitize methods in interpolation

上级 fbe67ebd
......@@ -454,7 +454,10 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck
end
end
IGNORE_METHODS_IN_SQL = Set[:id, :table_name, :to_i, :to_f]
IGNORE_METHODS_IN_SQL = Set[:id, :table_name, :to_i, :to_f,
:sanitize_sql, :sanitize_sql_array, :sanitize_sql_for_assignment,
:sanitize_sql_for_conditions, :sanitize_sql_hash,
:sanitize_sql_hash_for_assignment, :sanitize_sql_hash_for_conditions]
def safe_value? exp
return true unless sexp? exp
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册