False positive when passing a command array to Open3.pipeline

[alexandergitter]

Background

Brakeman version: 6.1.2
Rails version: 7.2.0
Ruby version: 3.3.4

Link to Rails application code: -

False Positive

Full warning from Brakeman:

Confidence: High
Category: Command Injection
Check: Execute
Message: Possible command injection
Code: Open3.pipeline(["ls", params["test"]])
File: a_file.rb
Line: 9

Relevant code:

Open3.pipeline(["ls", params["test"]])

Why might this be a false positive?
As far as I know, passing an array for a command to Open3.pipeline will treat the first element as the command and all other elements as parameters to the command, which makes the parameter elements safe against command injections.

[presidentbeef]

Agree.

Pretty sure when those methods were adding to the check, I gave up on tracking down the specifics of every safe/unsafe way of running commands...