Tidy up PotentiallyUnsafeSqlExecutingMethodCall characteristic predicate

Co-authored-by: Nick Rolfe <nickrolfe@github.com>
This commit is contained in:
Alex Ford
2021-06-17 14:39:40 +01:00
committed by GitHub
parent bf43a77df5
commit 12a0af1d28

View File

@@ -53,12 +53,15 @@ class ActiveRecordModelClassMethodCall extends MethodCall {
}
}
private predicate methodCanTakeSqlFragmentAsFirstArg(string methodName) {
private predicate methodWithSqlFragmentArg(string methodName, int argIndex) {
methodName =
[
"delete_all", "destroy_all", "exists?", "find_by", "find_by_sql", "from", "group", "having",
"joins", "lock", "not", "order", "pluck", "where"
]
] and
argIndex = 0
or
methodName = "calculate" and argIndex = 1
}
class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMethodCall {
@@ -73,12 +76,7 @@ class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMeth
PotentiallyUnsafeSqlExecutingMethodCall() {
methodName = this.getMethodName() and
sqlFragmentExpr = this.getArgument(sqlFragmentArgumentIndex) and
(
methodName = "calculate" and sqlFragmentArgumentIndex = 1
or
sqlFragmentArgumentIndex = 0 and
methodCanTakeSqlFragmentAsFirstArg(methodName)
) and
methodWithSqlFragmentArg(methodName, sqlFragmentArgumentIndex) and
(
// select only literals containing an interpolated value...
exists(StringInterpolationComponent interpolated |