Security Warning - Cross-Site Scripting

[pandu-cls]

We are using Loofah as a dependency on some other gem. When it got upgraded to latest version 2.10.0 our brakeman is showing a security warning (Cross-Site Scripting). Please take a look at below for more details.

We are using below versions. Rails - 6.1.3.2 Ruby - 2.7.4 Brakeman - 4.8.2

Please let us know if any resolution is made or we have to downgrade to 2.9.1

[flavorjones]

@pandu-cls Thanks for asking this question. I believe this is a bug in brakeman that has been fixed if you upgrade to the latest version. See these issues for deeper context:

• https://github.com/flavorjones/loofah/issues/210
• https://github.com/flavorjones/loofah/issues/209
• https://github.com/presidentbeef/brakeman/issues/1603
• https://github.com/presidentbeef/brakeman/pull/1604

[flavorjones]

I've pinned #209 to hopefully help others who see this.

[pandu-cls]

@flavorjones Thank you very much for quick response. We have upgraded our brakeman version and it start passing now. Appreciated 👍