Add Check: REDoS from match/match? coercing unsafe strings to regular expressions

[bensheldon]

Is your feature request related to a problem? Please describe.

Ruby's #match and #match? methods will coerce string inputs to regular expressions (docs):

Computes regexp by converting pattern (if not already a Regexp).

Example:

irb(main):001:0> RUBY_VERSION
=> "3.1.2"
irb(main):002:0> "haystack".match?(".*")
=> true
irb(main):003:0> "haystack".match(".*")
=> #<MatchData "haystack">
irb(main):004:0> "haystack".match? Regexp.escape(".*")
=> false

This is unsafe. Currently Brakeman checks for unescaped regex construction like /#{params[:regex]}/, but does not check for string coercion by match or match?.

Describe the solution you'd like

I'd like Brakeman to add a check for match and match? called with unsafe string input.

Thank you 🙏