Brakeman Warning Dynamic Render Path

Question

I have code. users_controller.rb

  def show
    @user = User.find_by id: params[:id]
    @microposts = @user.microposts.order_micropost.paginate(page: params[:page], per_page: 5)
  end

And view/user/show.html.erb

<% provide :title, @user.name %>
<div class="row">
  <aside class="col-md-4">
    <section class="user-info">
      <h1>
        <%= gravatar_for @user %>
        <%= @user.name %>
      </h1>
    </section>
  </aside>
  <div class="col-md-8">
    <% if @user.microposts.any? %>
      <h3><%= t ".count_microposts", count:  @user.microposts.count %></h3>
      <ol class="microposts">
        <%= render @microposts %>
      </ol>
      <%= will_paginate @microposts %>
    <% end %>
  </div>
</div>

In micropost/_micropost.html.erb

<li id="micropost-<%= micropost.id %>">
  <span class="user">
    <%= link_to micropost.user.name, micropost.user %>
  </span>
  <span class="content">
    <%= micropost.content %>
    <%= image_tag micropost.picture.url if micropost.picture? %>
  </span>
  <span class="timestamp">
    <span class="timeago" title=<%= micropost.created_at %>></span>
  <% if current_user.current_user?(micropost.user) %>
    <%= link_to t(".delete"), micropost, method: :delete,
      data: { confirm: t(".confirm") } %>
  <% end %>
  </span>
</li>

And i brakenman warning Dynamic Render Path, and hightlight <%= render @microposts %>. How can i fix it to pass brakenman ?

This is the exact error:

Render path contains parameter value near line 15: render(action => User.find_by(:id => params[:id]).microposts.order_micropost.paginate(:page => params[:page]), {})

You should show the exact error you are getting as text in the body of the question. — , Jan 09 '18 at 16:18
This is exact error `Render path contains parameter value near line 15: render(action => User.find_by(:id => params[:id]).microposts.order_micropost.paginate(:page => params[:page]), {})` — Trần Hồng, Jan 09 '18 at 16:22

score 4 · Accepted Answer · edited Jul 31 '21 at 22:08

4

It's a known issue with brakeman, if you just want the code to pass brakeman, you can change <%= render @microposts %> to <%= render partial: 'micropost', :collection => @microposts %>.

Source: https://github.com/presidentbeef/brakeman/pull/529

edited Jul 31 '21 at 22:08

Alexander

1,072
1
5
9

answered Jan 09 '18 at 17:13

Anurag Aryan

611
6
16

When i type this, Rails raise error: `Missing partial users/_micropost, application/_micropost with {:locale=>[:en], :formats=>[:html], :variants=>[], :handlers=>[:raw, :erb, :html, :builder, :ruby, :coffee, :jbuilder]}.` . I fix then `<%= render 'microposts/micropost', :collection => @microposts %> have error `undefined local variable or method `micropost'`. Can you help me fix it ? – Trần Hồng Jan 10 '18 at 12:49
@TrầnHồng `_micropost.html.erb` should ideally go inside `view/user` folder as the partials are being used for index view of user. If there's some particular reason you want it inside `view/micropost`, you'll write it as `<%= render 'micropost/micropost', collection: @microposts %>` or `<%= render partial: 'micropost/micropost', collection: @microposts %>`. In your fix there's a typo, you're writing `microposts` but your folder name is `micropost`. – Anurag Aryan Jan 10 '18 at 17:15
1

The syntax that worked for me was ``` = render partial: 'review', collection: @reviews ``` – Petercopter Nov 30 '20 at 18:55

score 0 · Answer 2 · answered Oct 02 '21 at 07:25

0

No need for partial and collection in my case, I changed from:

render @attendance

to

render "attendances/attendance", attendance: @attendance

answered Oct 02 '21 at 07:25

Dorian

7,749
4
38
57

Brakeman Warning Dynamic Render Path

2 Answers2