Avoid warning about Symbol DoS on Model#attributes

lib/brakeman/checks/check_symbol_dos.rb

@@ -33,8 +33,10 @@ def check_unsafe_symbol_creation result
       confidence = :medium
     end
 
+
     if confidence
       return if safe_parameter? input.match
+      return if symbolizing_attributes? input
 
       message = "Symbol conversion from unsafe string (#{friendly_type_of input})"
 
@@ -60,4 +62,10 @@ def safe_parameter? input
       false
     end
   end
+
+  def symbolizing_attributes? input
+    input.type == :model and
+      call? input.match and
+      input.match.method == :attributes
+  end
 end

test/apps/rails4/app/models/user.rb

@@ -43,4 +43,8 @@ def self.encrypt_pass password
   end
 
   accepts_nested_attributes_for :something, allow_destroy: false, reject_if: proc { |attributes| stuff }
+
+  def more_symbol_stuff stuff
+    User.find(stuff).attributes.symbolize_keys # meh, don't warn
+  end
 end

test/tests/rails4.rb

@@ -536,6 +536,19 @@ def test_symbol_dos_with_safe_parameters
       :user_input => s(:call, s(:params), :[], s(:lit, :action))
   end
 
+  def test_symbol_dos_on_model_attributes
+    assert_no_warning :type => :warning,
+      :warning_code => 59,
+      :fingerprint => "0bc13d07b15305ddff2b095ccaf49ab8301fc0d917e5a444bcfe418429324a68",
+      :warning_type => "Denial of Service",
+      :line => 48,
+      :message => /^Symbol\ conversion\ from\ unsafe\ string\ \(mo/,
+      :confidence => 1,
+      :relative_path => "app/models/user.rb",
+      :code => s(:call, s(:call, s(:call, s(:const, :User), :find, s(:lvar, :stuff)), :attributes), :symbolize_keys),
+      :user_input => s(:call, s(:call, s(:const, :User), :find, s(:lvar, :stuff)), :attributes)
+  end
+
   def test_regex_denial_of_service
     assert_warning :type => :warning,
       :warning_code => 76,