Fix ERB parsing <%==

also update BLOCK_EXPR regex from head Rails

lib/brakeman/parsers/rails3_erubis.rb

@@ -29,7 +29,7 @@ class Brakeman::Rails3Erubis < ::Erubis::Eruby
     end
   end
 
-  BLOCK_EXPR = /\s+(do|\{)(\s*\|[^|]*\|)?\s*\Z/
+  BLOCK_EXPR = /\s*((\s+|\))do|\{)(\s*\|[^|]*\|)?\s*\Z/
 
   def add_expr_literal(src, code)
     if code =~ BLOCK_EXPR
@@ -43,7 +43,7 @@ class Brakeman::Rails3Erubis < ::Erubis::Eruby
     if code =~ BLOCK_EXPR
       src << "@output_buffer.safe_append= " << code
     else
-      src << "@output_buffer.safe_concat(" << code << ");"
+      src << "@output_buffer.safe_append= (" << code << ");"
     end
   end
 

test/apps/rails4/app/views/users/test_parse.html.erb

+Testing double ==
+<%== %{t="#{stuff unless other? }"} if current_user %>