diff --git a/lib/brakeman/processors/controller_alias_processor.rb b/lib/brakeman/processors/controller_alias_processor.rb index e13cea3dd..151b274e9 100644 --- a/lib/brakeman/processors/controller_alias_processor.rb +++ b/lib/brakeman/processors/controller_alias_processor.rb @@ -224,7 +224,7 @@ def layout_name #Returns true if the given method name is also a route def route? method if @tracker.routes[:allow_all_actions] or @tracker.options[:assume_all_routes] - true + not @tracker.controllers[@current_class].private? method else routes = @tracker.routes[@current_class] routes and (routes.include? :allow_all_actions or routes.include? method) diff --git a/lib/brakeman/tracker/collection.rb b/lib/brakeman/tracker/collection.rb index 0255b1aee..565db82d6 100644 --- a/lib/brakeman/tracker/collection.rb +++ b/lib/brakeman/tracker/collection.rb @@ -115,6 +115,10 @@ def methods_public @methods[:public] end + def private? name + @methods[:private].has_key? name + end + def get_simple_method_return_value type, name @simple_methods[type][name] end