# File lib/brakeman/checks/check_sql.rb, line 279 def check_query_arguments arg return unless sexp? arg first_arg = arg[1] if node_type? arg, :arglist if arg.length > 2 and string_interp? first_arg # Model.where("blah = ?", blah) return check_string_interp first_arg else arg = first_arg end end if request_value? arg unless call? arg and params? arg.target and [:permit, :slice, :to_h, :to_hash, :symbolize_keys].include? arg.method # Model.where(params[:where]) arg end elsif hash? arg #This is generally going to be a hash of column names and values, which #would escape the values. But the keys _could_ be user input. check_hash_keys arg elsif node_type? arg, :lit, :str nil else #Hashes are safe...but we check above for hash, so...? unsafe_sql? arg, :ignore_hash end end