{"action":"opened","issue":{"url":"https://api.github.com/repos/presidentbeef/brakeman/issues/1182","repository_url":"https://api.github.com/repos/presidentbeef/brakeman","labels_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/1182/labels{/name}","comments_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/1182/comments","events_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/1182/events","html_url":"https://github.com/presidentbeef/brakeman/issues/1182","id":317339754,"number":1182,"title":"Possible ActiveRecord false positive?","user":{"login":"JacobEvelyn","id":1114569,"avatar_url":"https://avatars3.githubusercontent.com/u/1114569?v=4","gravatar_id":"","url":"https://api.github.com/users/JacobEvelyn","html_url":"https://github.com/JacobEvelyn","followers_url":"https://api.github.com/users/JacobEvelyn/followers","following_url":"https://api.github.com/users/JacobEvelyn/following{/other_user}","gists_url":"https://api.github.com/users/JacobEvelyn/gists{/gist_id}","starred_url":"https://api.github.com/users/JacobEvelyn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JacobEvelyn/subscriptions","organizations_url":"https://api.github.com/users/JacobEvelyn/orgs","repos_url":"https://api.github.com/users/JacobEvelyn/repos","events_url":"https://api.github.com/users/JacobEvelyn/events{/privacy}","received_events_url":"https://api.github.com/users/JacobEvelyn/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-04-24T18:17:08Z","updated_at":"2018-04-24T18:17:08Z","closed_at":null,"author_association":"NONE","body":"### Background\r\n\r\nBrakeman version: 4.2.1\r\nRails version: 5.1.6\r\nRuby version: 2.5.0\r\n\r\n#### False Positive\r\n\r\nSorry to bug you since I suspect it doesn't make sense to have brakeman handle this case. We've got a fairly complex query we construct in our code, which uses a subquery. To stay sane, we alias the table in the subquery and use a Ruby constant to ensure we're using the same table alias everywhere. In the end, we have code looking something like this:\r\n\r\n```ruby\r\nSUBQUERY_TABLE_ALIAS = \"my_table_alias\".freeze\r\n\r\n# This is used inside a larger query by using `inner_query.to_sql`\r\ndef inner_query\r\n  self.class.\r\n    select(\"#{SUBQUERY_TABLE_ALIAS}.*\").\r\n    from(\"#{table_name} AS #{SUBQUERY_TABLE_ALIAS}\")\r\nend\r\n```\r\n\r\nBrakeman warns us of possible SQL injection here, which is fair as we're injecting a string into our SQL without sanitizing (interestingly, it only warns about the `SUBQUERY_TABLE_ALIAS ` usage, not the `table_name` usage):\r\n\r\n```\r\nConfidence: Weak\r\nCategory: SQL Injection\r\nCheck: SQL\r\nMessage: Possible SQL injection\r\nCode: self.class.select(\"#{\"my_table_alias\".freeze}.*\").from(\"#{table_name} AS #{\"my_table_alias\".freeze}\")\r\nFile: app/models/concerns/sequenced.rb\r\nLine: 41\r\n```\r\n\r\nHowever, since `SUBQUERY_TABLE_ALIAS` is a frozen constant in our code I wonder if there's a way for brakeman to ignore this.\r\n\r\nWe're happy to just add this to our `config/brakeman.ignore` file, but I just wanted to check that you didn't think this is something brakeman should be smarter about.\r\n\r\nAs always, I'd be happy to work on a PR if I'm able to."}}
{"actor":{"display_login":"JacobEvelyn"}}