chore: Fix brakeman warnings

ClarifiedSecurity · Dec 5, 2023 · ddd16e8 · ddd16e8
1 parent eb3db5d
commit ddd16e8
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 3 deletions.
diff --git a/app/calculation/clone_environment.rb b/app/calculation/clone_environment.rb
@@ -86,8 +86,8 @@ def clone_customization_specs(current_specs:, vm_id:)
 
       if combined_data[:capabilities].any?
         ActiveRecord::Base.connection.execute <<-SQL
-          INSERT INTO capabilities_customization_specs (#{combined_data[:capabilities].first.keys.join(",")}) VALUES
-          #{combined_data[:capabilities].map(&:values).map { |values| "(#{values.join(",")})" }.join(", ")}
+          INSERT INTO capabilities_customization_specs (#{ActiveRecord::Base.connection.quote(combined_data[:capabilities].first.keys.join(","))}) VALUES
+          #{ActiveRecord::Base.connection.quote(combined_data[:capabilities].map(&:values).map { |values| "(#{values.join(",")})" }.join(", "))}
         SQL
       end
     end

diff --git a/app/models/check.rb b/app/models/check.rb
@@ -91,7 +91,7 @@ def relation_to_api_name(relation)
     def relation_to_icon(relation)
       case relation
       when CustomCheckSubject
-        relation.base_class.constantize.to_icon
+        relation.safe_class.to_icon
       when Network, CustomizationSpec
         relation.class.to_icon
       end

diff --git a/app/models/custom_check_subject.rb b/app/models/custom_check_subject.rb
@@ -12,4 +12,10 @@ def api_name
   def type_for_api
     'custom'
   end
+
+  def safe_class
+    if %w(CustomizationSpec Network).include?(base_class)
+      base_class.to_s.constantize
+    end
+  end
 end