Command injection false positive

[JacobEvelyn]

Background

Brakeman version: 4.2.1
Rails version: 5.1.6
Ruby version: 2.5.1

False Positive

Full warning from Brakeman:

Confidence: Medium
Category: Command Injection
Check: Execute
Message: Possible command injection
Code: system("echo #{Shellwords.escape("#{file_prefix}.txt")}")
File: app/controllers/api/v1/application_controller.rb
Line: 12

Relevant code:

def safe(file_prefix)
  filename = Shellwords.escape("#{file_prefix}.txt")
  system("echo #{filename}")
end

I believe this is a false positive because even if file_prefix contains dangerous user input, it will be escaped before the system call. I might be missing something though.

[presidentbeef]

This was confusing, because I recently fixed false positives with Shellwords...but the nested interpolation was the problem.

Thank you for reporting!