Skip to content

False positive warning when rendering a partial that has a local called text #1915

@strika

Description

@strika

Background

Brakeman version: 7.0.0
Rails version: 7.1.5.1
Ruby version: 3.3.7

Issue

The following code:

<%= render(
  "inventory_unit/shared/inventory_record",
  text: params.dig(:inventory_unit, :inventory_record, :comment)
) %>

Produces:

Confidence: High
Category: Cross-Site Scripting
Check: RenderInline
Message: Unescaped parameter value rendered inline
Code: render(text => params.dig(:inventory_unit, :inventory_record, :comment), {})
File: app/inventory/views/inventory_unit/new.html.erb
Line: 86

However, changing the parameter name from text to comment doesn't produce a warning:

<%= render(
  "inventory_unit/shared/inventory_record",
  comment: params.dig(:inventory_unit, :inventory_record, :comment)
) %>

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions