Command injection false positive with interpolated ternary

[bannable]

Background

Brakeman version: 4.3.0 (pro)
Rails version: 3.2.22.8
Ruby version: 2.3.7p456

False Positive

Full warning from Brakeman:

Confidence: Medium
Category: Command Injection
Check: Execute
Code: system("echo #{f ? ("-n ") : ("")}")
File: lib/hello.rb
Line: 3

Relevant code:

def safe(f=false)
  system "echo #{f ? '-n ' : ''}"
end

Why might this be a false positive?

There is no user input to the system call. Interestingly, this also causes brakeman to miss this injection, and report only the ternary as a problem:

  def unsafe(file, f=false)
    system "echo #{f ? '-n ' : ''} < #{file}"
  end

[presidentbeef]

Hi Joe,

Thank you for reporting this issue and for the clear code examples. This was fixed on master with #1214.