Brakeman Warning Dynamic Render Path

Question

I have code. users_controller.rb

  def show
    @user = User.find_by id: params[:id]
    @microposts = @user.microposts.order_micropost.paginate(page: params[:page], per_page: 5)
  end

And view/user/show.html.erb

<% provide :title, @user.name %>
<div class="row">
  <aside class="col-md-4">
    <section class="user-info">
      <h1>
        <%= gravatar_for @user %>
        <%= @user.name %>
      </h1>
    </section>
  </aside>
  <div class="col-md-8">
    <% if @user.microposts.any? %>
      <h3><%= t ".count_microposts", count:  @user.microposts.count %></h3>
      <ol class="microposts">
        <%= render @microposts %>
      </ol>
      <%= will_paginate @microposts %>
    <% end %>
  </div>
</div>

In micropost/_micropost.html.erb

<li id="micropost-<%= micropost.id %>">
  <span class="user">
    <%= link_to micropost.user.name, micropost.user %>
  </span>
  <span class="content">
    <%= micropost.content %>
    <%= image_tag micropost.picture.url if micropost.picture? %>
  </span>
  <span class="timestamp">
    <span class="timeago" title=<%= micropost.created_at %>></span>
  <% if current_user.current_user?(micropost.user) %>
    <%= link_to t(".delete"), micropost, method: :delete,
      data: { confirm: t(".confirm") } %>
  <% end %>
  </span>
</li>

And i brakenman warning Dynamic Render Path, and hightlight <%= render @microposts %>. How can i fix it to pass brakenman ?

This is the exact error:

Render path contains parameter value near line 15: render(action => User.find_by(:id => params[:id]).microposts.order_micropost.paginate(:page => params[:page]), {})

Answer 1

It's a known issue with brakeman, if you just want the code to pass brakeman, you can change <%= render @microposts %> to <%= render partial: 'micropost', :collection => @microposts %>.

Source: https://github.com/presidentbeef/brakeman/pull/529