False positive ForgerySetting warning when Application class uses :: syntax

[mockdeep]

Background

Brakeman version: 8.0.2
Rails version: 8.1.2
Ruby version: 4.0.1

Link to Rails application code: https://github.com/stringer-rss/stringer

Issue

When an application uses module shorthand syntax, Brakeman reports a false positive for "Cross-Site Request Forgery". Full warning from Brakeman:

[High] Cross-Site Request Forgery: protect_from_forgery should be called in ApplicationController (app/controllers/application_controller.rb:3)

Relevant code in config/application.rb:

class Stringer::Application < Rails::Application
  config.load_defaults(8.0)
end

When I expand this to the following, the warning goes away:

module Stringer
  class Application < Rails::Application
    config.load_defaults(8.0)
  end
end

[loqimean]

the same issue with rails 8.0

[presidentbeef]

Thanks for reporting! Weird this has never come up before.

[mockdeep]

It's fairly benign, to be honest. I'd have probably just added it to the controller if I hadn't been looking at another project for reference.