labml
labml copied to clipboard
False positive warning when rendering a partial that has a local called `text`
Background
Brakeman version: 7.0.0 Rails version: 7.1.5.1 Ruby version: 3.3.7
Issue
The following code:
<%= render(
"inventory_unit/shared/inventory_record",
text: params.dig(:inventory_unit, :inventory_record, :comment)
) %>
Produces:
Confidence: High
Category: Cross-Site Scripting
Check: RenderInline
Message: Unescaped parameter value rendered inline
Code: render(text => params.dig(:inventory_unit, :inventory_record, :comment), {})
File: app/inventory/views/inventory_unit/new.html.erb
Line: 86
However, changing the parameter name from text to comment doesn't produce a warning:
<%= render(
"inventory_unit/shared/inventory_record",
comment: params.dig(:inventory_unit, :inventory_record, :comment)
) %>