False positive SQL injection for quoted_primary_key, quoted_table_name

[md5]

I have some code that is dynamically constructing SQL using quoted_primary_key and quoted_table_name from ActiveRecord::ModelSchema::ClassMethods. Brakeman is reporting these as a possible SQL injection, which is not the case with the default implementation of these methods. I suppose someone could override them for their class and introduce an SQL injection vector, but this seems like a false positive to me.

[presidentbeef]

Hi Mike,

You are right, at the moment Brakeman ignores quoted_table_name but not quoted_primary_key. I'm guessing it is warning about the latter. Can you provide an example? Thanks!

[md5]

def self.self_and_descendants_for(id)
    where(<<-SQL, id: id)
      #{quoted_table_name}.#{quoted_primary_key} IN (
        WITH RECURSIVE descendant_tree(#{quoted_primary_key}, path) AS (
            SELECT #{quoted_primary_key}, ARRAY[#{quoted_primary_key}]
            FROM #{quoted_table_name}
            WHERE #{quoted_primary_key} = :id
          UNION ALL
            SELECT #{quoted_table_name}.#{quoted_primary_key}, descendant_tree.path || #{quoted_table_name}.#{quoted_primary_key}
            FROM descendant_tree
            JOIN #{quoted_table_name} ON #{quoted_table_name}.parent_id = descendant_tree.#{quoted_primary_key}
            WHERE NOT #{quoted_table_name}.#{quoted_primary_key} = ANY(descendant_tree.path)
        )
        SELECT #{quoted_primary_key}
        FROM descendant_tree
        ORDER BY path
      )
    SQL
end

[md5]

👍