def check_unsafe_symbol_creation result
return unless original? result
call = result[:call]
if result[:method] == :literal_to_sym
args = call.select { |e| sexp? e }
else
args = [call.target]
end
if input = args.map{ |arg| has_immediate_user_input?(arg) }.compact.first
confidence = :high
elsif input = args.map{ |arg| include_user_input?(arg) }.compact.first
confidence = :medium
end
if confidence
return if safe_parameter? input.match
return if symbolizing_attributes? input
message = msg("Symbol conversion from unsafe string in ", msg_input(input))
warn :result => result,
:warning_type => "Denial of Service",
:warning_code => :unsafe_symbol_creation,
:message => message,
:user_input => input,
:confidence => confidence
end
end