Command injection warning expected but missed

[JacobEvelyn]

Background

Brakeman version: 4.2.1
Rails version: 5.1.6
Ruby version: 2.3.4

Issue

Similar to #1179, I'd expect the following code to produce a command injection warning in brakeman:

def dangerous(foo)
  system("echo " + foo)
end

Would it be possible to get brakeman to transform that into system("echo #{foo}"), similar to your suggested solution for #1179?

[presidentbeef]

In this case I'd rather check for string concatenation the way the SQLi check does.

[JacobEvelyn]

That works too!

[JacobEvelyn]

@presidentbeef any updates on this?