Merge pull request #1821 from vividmuimui/view_component_contrib_base

fix: avoid detecting 'ViewComponentContrib::Base' as dynamic render paths

lib/brakeman/checks/check_render.rb

@@ -108,6 +108,11 @@ def renderable? exp
   def known_renderable_class? class_name
     klass = tracker.find_class(class_name)
     return false if klass.nil?
-    klass.ancestor?(:"ViewComponent::Base") || klass.ancestor?(:"Phlex::HTML")
+    knowns = [
+      :"ViewComponent::Base",
+      :"ViewComponentContrib::Base",
+      :"Phlex::HTML"
+    ]
+    knowns.any? { |k| klass.ancestor? k }
   end
 end

test/apps/rails6/app/components/test_view_component_contrib.rb

@@ -0,0 +1,5 @@
+class TestViewComponentContrib < ViewComponentContrib::Base
+  def initialize(prop)
+    @prop = prop
+  end
+end

test/apps/rails6/app/controllers/groups_controller.rb

@@ -84,4 +84,8 @@ def enum_include_check
   def render_phlex_component
     render(TestPhlexComponent.new(params.require('name')))
   end
+
+  def render_view_component_contrib
+    render(TestViewComponentContrib.new(params.require('name')))
+  end
 end

test/tests/rails6.rb

@@ -643,6 +643,18 @@ def test_dynamic_render_path_phlex_component
       :user_input => s(:call, s(:params), :require, s(:str, "name"))
   end
 
+  def test_dynamic_render_view_component_contrib
+    assert_no_warning :type => :warning,
+      :warning_code => 15,
+      :warning_type => "Dynamic Render Path",
+      :line => 88,
+      :message => /^Render\ path\ contains\ parameter\ value/,
+      :confidence => 2,
+      :relative_path => "app/controllers/groups_controller.rb",
+      :code => s(:render, :action, s(:call, s(:const, :TestViewComponentContrib), :new, s(:call, s(:params), :require, s(:str, "name"))), s(:hash)),
+      :user_input => s(:call, s(:params), :require, s(:str, "name"))
+  end
+
   def test_dynamic_render_path_dir_glob_filter
     assert_no_warning :type => :warning,
       :warning_code => 15,