Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: avoid detecting 'ViewComponentContrib::Base' as dynamic render paths #1821

Merged

Conversation

vividmuimui
Copy link
Contributor

Description 📖

This pull request adds support for view_component-contrib gem.
view_component-contrib is a support library for ViewComponent, which defines ViewComponent using the class SomeComponent < ViewComponentContrib::Base instead of class SomeComponent < ViewComponent::Base.
(ViewComponentContrib::Base is a class that extends ViewComponent::Base (see: https://github.com/palkan/view_component-contrib/blob/master/lib/ view_component_contrib/base.rb))

This PR prevents brakeman from detecting a Component using ViewCompontontrib as an occurrence of Dynamic Render Paths.

Background 📜

This problem is similar to what used to happen in the past for view_components:

#1529
#1578
#1805

Copy link

dryrunsecurity bot commented Jan 25, 2024

Contextual Security Analysis

As DryRun Security performs checks, we’ll summarize them here. You can always dive into the detailed results in the section below for checks.

Status DryRun Security Check
AI-powered Sensitive Function Check
Configured Sensitive Files Check
AI-powered Sensitive Files Check

Chat with your AI-powered Security Buddy by typing @dryrunsecurity followed by your question into a comment.
Example: @dryrunsecurity What are common security issues with web application cookies?

Install and configure more repositories at DryRun Security

@presidentbeef presidentbeef merged commit fe9e0a3 into presidentbeef:main Jan 29, 2024
12 checks passed
@presidentbeef
Copy link
Owner

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants