提交 c3329e7c 编写于 作者: J Justin Collins

Don't warn when calling send on user input

We have warnings for use of constantize and for using
send/try/etc with user input for the method name.
上级 b2ee5627
......@@ -28,15 +28,5 @@ class Brakeman::CheckSend < Brakeman::BaseCheck
:user_input => input.match,
:confidence => CONFIDENCE[:high]
end
if input = has_immediate_user_input?(target)
warn :result => result,
:warning_type => "Dangerous Send",
:warning_code => :dangerous_send,
:message => "User defined target of method invocation",
:code => result[:call],
:user_input => input.match,
:confidence => CONFIDENCE[:med]
end
end
end
......@@ -12,13 +12,13 @@ class Rails2Tests < Test::Unit::TestCase
:controller => 1,
:model => 3,
:template => 41,
:warning => 42 }
:warning => 40 }
else
@expected ||= {
:controller => 1,
:model => 3,
:template => 41,
:warning => 43 }
:warning => 41 }
end
end
......@@ -753,7 +753,7 @@ class Rails2Tests < Test::Unit::TestCase
:confidence => 0,
:file => /home_controller\.rb/
assert_warning :type => :warning,
assert_no_warning :type => :warning,
:warning_type => "Dangerous Send",
:line => 90,
:message => /\AUser defined target of method invocation/,
......@@ -909,7 +909,7 @@ class Rails2Tests < Test::Unit::TestCase
end
def test_dangerous_try_on_user_input
assert_warning :type => :warning,
assert_no_warning :type => :warning,
:warning_type => "Dangerous Send",
:line => 160,
:message => /^User\ defined\ target\ of\ method\ invocation/,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册