ruby.rails.security.audit.xss.templates.unquoted-attribute.unquoted-attribute false positives #3539
Open
Description
Describe the bug
False positives for patterns that are wrapped in parentheses
To Reproduce
<!-- ok: unquoted-attribute -->
<div style="max-width: <%= width || "100%" %>;"> </div>
<!-- ok: unquoted-attribute -->
<div href="foo/<%= "%>" %>"> </div>
Expected behavior
No warnings
Priority
How important is this to you?
- P0: blocking me from making progress
- P1: this will block me in the near future
- P2: annoying but not blocking me
Additional Context
Add any other context about the problem here.