Baike.dev
Log in
Back to tool/Back to issues
#1956·brakeman

[Format Error] on code field with Prism parser- Brakeman v7.0.2

Author: tsigouris007Created Jul 30, 2025Updated Jan 7, 2026

Background

Brakeman version: 7.0.2 Rails version: 7.0.8.7 Ruby version: 3.3.0

Link to Rails application code: Not available

Issue

What problem are you seeing?

Prism parser ends up with [Format Error] in the code output field (json option) on specific cases.
Examples:

json
    {
      "warning_type": "SQL Injection",
      "warning_code": 0,
      "fingerprint": "11f372833279ae3edbfc725a09e2ffc3e23d20c04c0743f1377eae091f45d7d7",
      "check_name": "SQL",
      "message": "Possible SQL injection",
      "file": "app/presenters/earth/ecommerce/stats/shipment_stats_presenter.rb",
      "line": 148,
      "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
      "code": "[Format Error]",
      "render_path": null,
      "location": {
        "type": "method",
        "class": "Earth::Ecommerce::Stats::ShipmentStatsPresenter",
        "method": "percentiled_time_for_transit_per_week_chart"
      },
      "user_input": "start_of_week_sql(\"created_at\")",
      "confidence": "Medium",
      "cwe_id": [
        89
      ]
    }
    ...
    {
      "warning_type": "SQL Injection",
      "warning_code": 0,
      "fingerprint": "5ff6fe0a2a4570e9c077a7cbd02aa352f329604328bb46dc7bec0dbe8d58db81",
      "check_name": "SQL",
      "message": "Possible SQL injection",
      "file": "app/presenters/earth/ecommerce/stats/shipment_stats_presenter.rb",
      "line": 160,
      "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/",
      "code": "[Format Error]",
      "render_path": null,
      "location": {
        "type": "method",
        "class": "Earth::Ecommerce::Stats::ShipmentStatsPresenter",
        "method": "percentiled_time_for_transit_per_week_chart"
      },
      "user_input": "start_of_week_sql(\"created_at\")",
      "confidence": "Medium",
      "cwe_id": [
        89
      ]
    }

We are currently "bypassing" this by using the --no-prism argument.

Other Error

Stack trace outputs:

/usr/src/app/lib/brakeman/commandline.rb:162:in `run_brakeman'
/usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
/usr/src/app/lib/brakeman/commandline.rb:171:in `run_report'
/usr/src/app/lib/brakeman/commandline.rb:35:in `run'
/usr/src/app/lib/brakeman/commandline.rb:20:in `start'
/usr/src/app/bin/brakeman:10:in `<main>'
While formatting s(:dstr, "", s(:evstr, s(:call, nil, :start_of_week_sql, s(:str, "created_at"))), s(:str, " as monday, "), "", s(:evstr, s(:call, nil, :working_minutes_sql, s(:str, "created_at"), s(:str, "merchant_responded_at"))), s(:str, " "), s(:str, "AS merchant_reaction")): undefined method `sexp_type' for an instance of String
/usr/src/app/lib/brakeman/commandline.rb:162:in `run_brakeman'
/usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
/usr/src/app/lib/brakeman/commandline.rb:171:in `run_report'
/usr/src/app/lib/brakeman/commandline.rb:35:in `run'
/usr/src/app/lib/brakeman/commandline.rb:20:in `start'
/usr/src/app/bin/brakeman:10:in `<main>'
While formatting s(:call, s(:const, :Arel), :sql, s(:dstr, "", s(:evstr, s(:call, nil, :start_of_week_sql, s(:str, "created_at"))), s(:str, " as monday, "), "", s(:evstr, s(:call, nil, :working_minutes_sql, s(:str, "created_at"), s(:str, "merchant_responded_at"))), s(:str, " "), s(:str, "AS merchant_reaction"))): undefined method `empty?' for nil
/usr/src/app/lib/brakeman/commandline.rb:162:in `run_brakeman'
/usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
/usr/src/app/lib/brakeman/commandline.rb:171:in `run_report'
/usr/src/app/lib/brakeman/commandline.rb:35:in `run'
/usr/src/app/lib/brakeman/commandline.rb:20:in `start'
/usr/src/app/bin/brakeman:10:in `<main>'
While formatting s(:dstr, "", s(:evstr, s(:call, nil, :start_of_week_sql, s(:str, "created_at"))), s(:str, " as monday, "), "", s(:evstr, s(:call, nil, :working_minutes_sql, s(:str, "created_at"), s(:str, "merchant_responded_at"))), s(:str, " "), s(:str, "AS merchant_reaction")): undefined method `sexp_type' for an instance of String
/usr/src/app/lib/brakeman/commandline.rb:162:in `run_brakeman'
/usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
/usr/src/app/lib/brakeman/commandline.rb:171:in `run_report'
/usr/src/app/lib/brakeman/commandline.rb:35:in `run'
/usr/src/app/lib/brakeman/commandline.rb:20:in `start'
/usr/src/app/bin/brakeman:10:in `<main>'
While formatting s(:call, s(:const, :Arel), :sql, s(:dstr, "", s(:evstr, s(:call, nil, :start_of_week_sql, s(:str, "created_at"))), s(:str, " as monday, "), "", s(:evstr, s(:call, nil, :working_minutes_sql, s(:str, "created_at"), s(:str, "merchant_responded_at"))), s(:str, " "), s(:str, "AS merchant_reaction"))): undefined method `empty?' for nil
/usr/src/app/lib/brakeman/commandline.rb:162:in `run_brakeman'
/usr/src/app/lib/brakeman/commandline.rb:125:in `regular_report'
/usr/src/app/lib/brakeman/commandline.rb:171:in `run_report'
/usr/src/app/lib/brakeman/commandline.rb:35:in `run'
/usr/src/app/lib/brakeman/commandline.rb:20:in `start'
/usr/src/app/bin/brakeman:10:in `<main>'
While formatting s(:dstr, "", s(:evstr, s(:call, nil, :start_of_week_sql, s(:str, "created_at"))), s(:str, " as monday, "), "", s(:evstr, s(:call, nil, :minutes_without_weekends_sql, s(:str, "created_at"), s(:str, "picked_up_at"))), s(:str, " AS pickup_time, "), "", s(:evstr, s(:call, nil, :minutes_without_weekends_sql, s(:str, "picked_up_at"), s(:str, "first_delivery_attempt_at"))), s(:str, " "), s(:str, "AS transit_time")): undefined method `sexp_type' for an instance of String

Source: presidentbeef/brakeman

View original on GitHubView discussion on GitHub