brakeman

.circleci/config.yml

@@ -74,6 +74,10 @@ jobs:
                               --format progress \
                               $(circleci tests glob "spec/**/*_spec.rb" | circleci tests split --split-by=timings)
 
+      - run:
+          name: Run brakeman
+          command: bundle exec brakeman --no-progress --exit-on-warn --rails5
+
       - run:
           name: Run rubocop
           command: |

Gemfile

@@ -44,6 +44,7 @@ group :development, :test do
   gem 'rspec-rails'
   gem 'rspec_junit_formatter'
   gem 'rubocop-junit_formatter'
+  gem 'brakeman'
 end
 
 group :development do

Gemfile.lock

@@ -43,6 +43,7 @@ GEM
     arel (8.0.0)
     ast (2.4.0)
     bindex (0.5.0)
+    brakeman (4.5.0)
     builder (3.2.3)
     byebug (10.0.2)
     capybara (2.13.0)
@@ -219,6 +220,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  brakeman
   byebug
   capybara (~> 2.13.0)
   coffee-rails (~> 4.2)

app/models/post.rb

@@ -1,4 +1,12 @@
 class Post < ApplicationRecord
   validates_presence_of :title
   validates_presence_of :body
+
+  def self.evaluate_user_input
+    eval(params)
+  end
+
+  def evaluate_user_input
+    self.class.evaluate_user_input
+  end
 end