def include_user_input? call, immediate = :immediate
Brakeman.debug "Checking if call includes user input"
arg = call.first_arg
return false if array? arg
if tracker.options[:ignore_redirect_to_model]
if model_instance?(arg) or decorated_model?(arg)
return false
end
end
if res = has_immediate_model?(arg)
unless call? arg and arg.method.to_s =~ /_path/
return Match.new(immediate, res)
end
elsif call? arg
if request_value? arg
return Match.new(immediate, arg)
elsif request_value? arg.target
return Match.new(immediate, arg.target)
elsif arg.method == :url_for and include_user_input? arg
return Match.new(immediate, arg)
elsif arg.method.to_s =~ /_(url|path)\z/
return false
end
elsif request_value? arg
return Match.new(immediate, arg)
end
if tracker.options[:check_arguments] and call? arg
include_user_input? arg, false
else
false
end
end