{"action":"created","issue":{"url":"https://api.github.com/repos/presidentbeef/brakeman/issues/604","labels_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/604/labels{/name}","comments_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/604/comments","events_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/604/events","html_url":"https://github.com/presidentbeef/brakeman/issues/604","id":53544127,"number":604,"title":"ARel query false positive in 3.0.0","user":{"login":"phene","id":166528,"avatar_url":"https://avatars.githubusercontent.com/u/166528?v=3","gravatar_id":"","url":"https://api.github.com/users/phene","html_url":"https://github.com/phene","followers_url":"https://api.github.com/users/phene/followers","following_url":"https://api.github.com/users/phene/following{/other_user}","gists_url":"https://api.github.com/users/phene/gists{/gist_id}","starred_url":"https://api.github.com/users/phene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phene/subscriptions","organizations_url":"https://api.github.com/users/phene/orgs","repos_url":"https://api.github.com/users/phene/repos","events_url":"https://api.github.com/users/phene/events{/privacy}","received_events_url":"https://api.github.com/users/phene/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-01-06T18:09:44Z","updated_at":"2015-03-13T17:15:47Z","closed_at":null,"body":"This code, which is an entirely self-contained ARel query, is falsely detected as SQL Injection:\r\n\r\n```ruby\r\ngroup_recipient = GroupRecipient.joins(:group).where(GroupRecipient.arel_table[:message_id].eq Message.arel_table[:id])\r\ngroup_with_special_property = group_recipient.where(:groups => { :private => false, :special_property => true })\r\nMessage.where(group_recipient.exists.not.or(group_with_special_property.exists))\r\n```\r\n\r\nSpecifically, the `group_recipient.exists` and `group_with_special_property.exists` being used in the 3rd line is being marked."},"comment":{"url":"https://api.github.com/repos/presidentbeef/brakeman/issues/comments/79149667","html_url":"https://github.com/presidentbeef/brakeman/issues/604#issuecomment-79149667","issue_url":"https://api.github.com/repos/presidentbeef/brakeman/issues/604","id":79149667,"user":{"login":"phene","id":166528,"avatar_url":"https://avatars.githubusercontent.com/u/166528?v=3","gravatar_id":"","url":"https://api.github.com/users/phene","html_url":"https://github.com/phene","followers_url":"https://api.github.com/users/phene/followers","following_url":"https://api.github.com/users/phene/following{/other_user}","gists_url":"https://api.github.com/users/phene/gists{/gist_id}","starred_url":"https://api.github.com/users/phene/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phene/subscriptions","organizations_url":"https://api.github.com/users/phene/orgs","repos_url":"https://api.github.com/users/phene/repos","events_url":"https://api.github.com/users/phene/events{/privacy}","received_events_url":"https://api.github.com/users/phene/received_events","type":"User","site_admin":false},"created_at":"2015-03-13T17:15:47Z","updated_at":"2015-03-13T17:15:47Z","body":"The latest version 3.0.2 just created several new ARel false-positives. These are starting to get expensive and risky to manage.\r\n\r\n```ruby\r\nGroupRecipient.joins(:group).where(GroupRecipient.arel_table[:message_id].eq arel_table[:id])\r\n```\r\n\r\n```ruby\r\n  scope :sorted_by, ->(field, asc) {\r\n    asc = ['desc', 'asc'].include?(asc) ? asc : 'asc'\r\n    ordering = if field == 'extension'\r\n      \"substring_index(#{table_name}.data_file_name, '.', -1) #{asc}\"\r\n    elsif SORTABLE_COLUMNS.include?(field)\r\n      { field.to_sym => asc.to_sym }\r\n    end\r\n    order(ordering)\r\n  }\r\n```\r\n"}}