Merge pull request #1019 from presidentbeef/avoid_recursive_concerns

Avoid recursive concerns

lib/brakeman/processors/controller_processor.rb

@@ -16,6 +16,7 @@ def initialize app_tree, tracker
     @current_module = nil
     @visibility = :public
     @file_name = nil
+    @concerns = Set.new
   end
 
   #Use this method to process a Controller
@@ -65,7 +66,8 @@ def process_concern concern_name
     return unless @current_class
 
     if mod = @tracker.find_class(concern_name)
-      if mod.options[:included]
+      if mod.options[:included] and not @concerns.include? concern_name
+        @concerns << concern_name
         process mod.options[:included].deep_clone
       end
     end

test/apps/rails5/app/controllers/concerns/concerning.rb

@@ -0,0 +1,7 @@
+module Concerning
+  extend ActiveSupport::Concern
+
+  included do
+    include Concerning
+  end
+end

test/apps/rails5/app/controllers/mixed_controller.rb

@@ -1,4 +1,5 @@
 class BaseController < ActionController::Base
   # No protect_from_forgery call, but one mixed in
   include ForgeryProtection
+  include Concerning
 end