Class | Brakeman::Rails3Erubis |
In: |
lib/brakeman/parsers/rails3_erubis.rb
|
Parent: | ::Erubis::Eruby |
This is from Rails 5 version of the Erubis handler github.com/rails/rails/blob/ec608107801b1e505db03ba76bae4a326a5804ca/actionview/lib/action_view/template/handlers/erb.rb#L7-L73
BLOCK_EXPR | = | /\s*((\s+|\))do|\{)(\s*\|[^|]*\|)?\s*\Z/ |
Erubis toggles <%= and <%== behavior when escaping is enabled. We override to always treat <%== as escaped.
This is borrowed from graphql‘s erb plugin: github.com/github/graphql-client/blob/51e76bd8d8b2ac0021d8fef7468b9a294e4bd6e8/lib/graphql/client/erubis.rb#L33-L38