Bug: false positive for security/detect-object-injection

[AnnAngela]

Bug: false positive for security/detect-object-injection

[nzakas]

From what I can tell, this rule is behaving as expected and the documentation needs updating. It currently flags any function call for which an argument in the form object[key] is passed. An assignment isn't necessary, especially because, in your case, foo is being read from the environment.

[AnnAngela]

@nzakas THX but can you explain a bit more clearly why the assignment isn't necessary?

I don't understand that why the obj[foo] would cause harm even though foo is "construct" or other special string.

Okay, I get it. The document should therefore be updated to include these scenarios.