false positive AND negative for XSS warning when using sanitize

[michaelglass]

Background

Brakeman version: 4.2.1
Rails version: 4.2.10
Ruby version: 2.3.4

Issue

correctly using sanitize produces a warning

= sanitize link_to(image_tag("icons/twitter-gray.svg"), team_member.twitter_url, target: "_blank")

Full Brakeman Warning:

Confidence: Weak
Category: Cross-Site Scripting
Check: LinkToHref
Message: Potentially unsafe model attribute in link_to href
Code: link_to(image_tag("icons/twitter-gray.svg"), TeamMember.find(params[:id]).twitter_url, :target => "_blank")
File: app/views/home/_team_member.html.haml
Line: 13

but incorrectly using it does not, despite the fact that this is unsafe

= link_to(image_tag("icons/twitter-gray.svg"), sanitize(team_member.twitter_url), target: "_blank")

[presidentbeef]

The second issue is resolved with #1192.

The first issue is a bit more difficult, still thinking about how to solve it. At first I was going to ignore it because it seemed nonsensical but after testing I see it does make the link safe...

[michaelglass]

@presidentbeef so actually, sanitize is only partially safe... it protects against javascript: but not data: (at least as of rails 4.2)

[michaelglass]

(also: thank you for your wonderful gem!)

[presidentbeef]

Confirmed in Rails 5.2 that you can still get a data: XSS payload in there.