Merge pull request #1737 from coderdojo-japan/fix/brakeman-dynamic-render-path

Dynamic Render Path警告の解消（Book.exist?の安全化）

Author: nacchan99

app/controllers/sotechsha2_pages_controller.rb

@@ -19,9 +19,14 @@ def find(title)
     end
 
     def exist?(title, page)
-      page.nil? ?
-        self.find(title).any? :
-        self.find(title).map(&:filename).include?(page + ".html")
+      return false unless page.present?
+  
+      view_paths = [
+        Rails.root.join("app/views/books/#{title}/#{page}.html.erb"),
+        Rails.root.join("app/views/#{title}/#{page}.html.erb")
+      ]
+  
+      view_paths.any? { |path| File.exist?(path) }
     end
   end
 

app/controllers/sotechsha_pages_controller.rb

@@ -1,28 +1,5 @@
 {
   "ignored_warnings": [
-    {
-      "warning_type": "Dynamic Render Path",
-      "warning_code": 15,
-      "fingerprint": "69b5a133fab8ea617d2581423cefaf077b9366e683c5fac715647bddeec7f50a",
-      "check_name": "Render",
-      "message": "Render path contains parameter value",
-      "file": "app/controllers/sotechsha_pages_controller.rb",
-      "line": 5,
-      "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
-      "code": "render(action => \"sotechsha_pages/#{params[:page]}\", {})",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "SotechshaPagesController",
-        "method": "show"
-      },
-      "user_input": "params[:page]",
-      "confidence": "Medium",
-      "cwe_id": [
-        22
-      ],
-      "note": ""
-    },
     {
       "warning_type": "Command Injection",
       "warning_code": 14,
@@ -188,29 +165,6 @@
       ],
       "note": ""
     },
-    {
-      "warning_type": "Dynamic Render Path",
-      "warning_code": 15,
-      "fingerprint": "c54623ebce2c2053b95088b9da8112aee962e7cadd79bd9b4b9afdedaddc15b1",
-      "check_name": "Render",
-      "message": "Render path contains parameter value",
-      "file": "app/controllers/sotechsha2_pages_controller.rb",
-      "line": 5,
-      "link": "https://brakemanscanner.org/docs/warning_types/dynamic_render_path/",
-      "code": "render(action => \"sotechsha2_pages/#{params[:page]}\", {})",
-      "render_path": null,
-      "location": {
-        "type": "method",
-        "class": "Sotechsha2PagesController",
-        "method": "show"
-      },
-      "user_input": "params[:page]",
-      "confidence": "Medium",
-      "cwe_id": [
-        22
-      ],
-      "note": ""
-    },
     {
       "warning_type": "Cross-Site Scripting",
       "warning_code": 2,