diff --git a/lib/brakeman/checks/check_sql.rb b/lib/brakeman/checks/check_sql.rb index 61a8528e8dc0370d42ce03d3521a930e123d2cf3..ad8d34a7d4b87a6b49442599229f6c82990f7e80 100644 --- a/lib/brakeman/checks/check_sql.rb +++ b/lib/brakeman/checks/check_sql.rb @@ -41,7 +41,7 @@ class Brakeman::CheckSQL < Brakeman::BaseCheck Brakeman.debug "Finding possible SQL calls using constantized()" calls.concat tracker.find_call(:methods => @sql_targets).select { |result| constantize_call? result } - connect_targets = active_record_models.keys + [nil, :"ActiveRecord::Base"] + connect_targets = active_record_models.keys + [:connection, :"ActiveRecord::Base"] calls.concat tracker.find_call(:targets => connect_targets, :methods => @connection_calls, :chained => true).select { |result| connect_call? result } Brakeman.debug "Finding calls to named_scope or scope" diff --git a/lib/brakeman/processors/lib/find_all_calls.rb b/lib/brakeman/processors/lib/find_all_calls.rb index da976741c9ed54b31272348e78f9997886703966..03590648ddfd16c13143119efd532385512ab928 100644 --- a/lib/brakeman/processors/lib/find_all_calls.rb +++ b/lib/brakeman/processors/lib/find_all_calls.rb @@ -152,6 +152,8 @@ class Brakeman::FindAllCalls < Brakeman::BasicProcessor def get_chain call if node_type? call, :call, :attrasgn get_chain(call.target) + [call.method] + elsif call.nil? + [] else [get_target(call)] end