diff --git a/lib/brakeman/checks/check_link_to_href.rb b/lib/brakeman/checks/check_link_to_href.rb index 5e1e4828490839cbe7edb2abe7c81f6024251bfa..8d153363c504bd2b29230f933e9022056b111deb 100644 --- a/lib/brakeman/checks/check_link_to_href.rb +++ b/lib/brakeman/checks/check_link_to_href.rb @@ -11,6 +11,8 @@ class Brakeman::CheckLinkToHref < Brakeman::CheckLinkTo @description = "Checks to see if values used for hrefs are sanitized using a :url_safe_method to protect against javascript:/data: XSS" + IGNORE_LIKE = /_path$/ + def run_check @ignore_methods = Set[:button_to, :check_box, :field_field, :fields_for, :hidden_field, @@ -89,4 +91,8 @@ class Brakeman::CheckLinkToHref < Brakeman::CheckLinkTo end end end + + def ignored_method? method + @ignore_methods.include? method or method.to_s =~ IGNORE_LIKE + end end