Check for .gitignore secrets in subdirectories

fixes #519

lib/brakeman/checks/check_session_settings.rb

@@ -134,12 +134,15 @@ class Brakeman::CheckSessionSettings < Brakeman::BaseCheck
   end
 
   def ignored? file
-    if @app_tree.exists? ".gitignore"
-      input = @app_tree.read(".gitignore")
+    [".", "config", "config/initializers"].each do |dir|
+      ignore_file = "#{dir}/.gitignore"
+      if @app_tree.exists? ignore_file
+        input = @app_tree.read(ignore_file)
 
-      input.include? file
-    else
-      false
+        return true if input.include? file
+      end
     end
+
+    false
   end
 end

test/tests/rescanner.rb

@@ -298,4 +298,17 @@ class RescannerTests < Test::Unit::TestCase
       assert_fixed 9
     end
   end
+
+  def test_gitignore_session_secret_subdir
+    gitignore = "config/initializers/.gitignore"
+
+    before_rescan_of gitignore do
+      append gitignore, "secret_token.rb"
+    end
+
+    assert_changes
+    assert_reindex :none
+    assert_fixed 1
+    assert_new 0
+  end
 end