Skip to content

class_eval with known safe strings showing as dangerous #1919

@kwerle

Description

@kwerle

Background

Brakeman version: 7.0.0
Rails version: 7.1
Ruby version: 3.3?

Issue

  ["good", "fine"].each do |suffix|
    class_eval <<-METHODS
      def method_that_is_#{suffix}
        puts suffix
      end
    METHODS
  end

yields

Confidence: Weak
Category: Dangerous Eval
Check: Evaluation
Message: Dynamic string evaluated as code
Code: class_eval("      def method_that_is_#{:BRAKEMAN_SAFE_LITERAL}\n        puts suffix\n      end\n")
File: app/models/myfile.rb
Line: 95

It looks like that's meant to be known safe. Used to list as safe.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions