Command injection warning silenced with equality operator

[JacobEvelyn]

Background

Brakeman version: 4.2.1
Rails version: 5.1.6
Ruby version: 2.3.4

Issue

I expect this code to produce a command injection warning in brakeman:

def dangerous(foo)
  `echo #{foo}` == "1"
end

but the == "1" appears to prevent brakeman from spotting the vulnerability.

[JacobEvelyn]

And, relatedly, brakeman does not warn about this either:

def dangerous(foo)
  !system("echo #{foo}")
end

[presidentbeef]

Thanks, Jake.

The first one appears to already be fixed on master.

The second one is an easy fix.