#1945·brakeman

Brakeman enum support broken?

Author: cubaseppCreated Jul 8, 2025Updated Jul 9, 2025

Background

Brakeman version: 7.0.2 Rails version: 7.2.2.1 Ruby version: 3.4.4

Link to Rails application code: ?

Issue

When I use an enum like:

self.where("thing IN #{Model.statuses[:value]}")

I get a Possible SQL injection Waning.

I believe the add_enum_method is not up to date? code

If step into this function for some reason the first two checks are false:

return unless hash? arg
return unless symbol? arg[1]

If it's really a bug I can try to fix it, can you confirm it's broken?

Other Error

Run Brakeman with --debug to see the full stack trace.

Stack trace:

Confidence: High
Category: SQL Injection
Check: SQL
Message: Possible SQL injection
Code: self.where("thing IN #{Model.statuses[:value]}")
File: app/models/model.rb
Line: