fix brakeman SQL injection warning

app/controllers/submitters_autocomplete_controller.rb

@@ -7,13 +7,15 @@ class SubmittersAutocompleteController < ApplicationController
   LIMIT = 100
 
   def index
-    submitters = search_submitters(@submitters)
+    field = SELECT_COLUMNS.find { |c| c == params[:field] }
+
+    submitters = search_submitters(@submitters, field)
 
     arel_columns = SELECT_COLUMNS.map { |col| Submitter.arel_table[col] }
 
     values =
-      if params[:field].present? && SELECT_COLUMNS.include?(params[:field])
+      if field
-        max_ids = submitters.group(params[:field]).limit(LIMIT).select(Submitter.arel_table[:id].maximum)
+        max_ids = submitters.group(field).limit(LIMIT).select(Submitter.arel_table[:id].maximum)
 
         submitters.where(id: max_ids).order(id: :desc).pluck(arel_columns)
       else
@@ -27,12 +29,12 @@ class SubmittersAutocompleteController < ApplicationController
 
   private
 
-  def search_submitters(submitters)
+  def search_submitters(submitters, field)
-    if SELECT_COLUMNS.include?(params[:field])
+    if field
       if Docuseal.fulltext_search?
-        Submitters.fulltext_search_field(current_user, submitters, params[:q], params[:field])
+        Submitters.fulltext_search_field(current_user, submitters, params[:q], field)
       else
-        column = Submitter.arel_table[params[:field].to_sym]
+        column = Submitter.arel_table[field.to_sym]
 
         term = "#{params[:q].downcase}%"