YAML.load marked as file access

[pupeno]

Hello,

I have the following line in a controller:

doc = YAML::load(params[:doc]) if params[:doc].present?

which brakeman is marking as a file access using a parameter:

File Access Parameter value used in file name near line 13: YAML.load(params[:doc])

but YAML::load seems to only load from a string, not a path like YAML::load_file. Thus, this is a false positive warning. Am I wrong or missing something?

[presidentbeef]

I think you are right.

This is due to the way the file access check is written (lazily).