hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 09:15:12 +02:00
Code Issues Packages Projects Releases Wiki Activity

Identify more vulnerable ActiveRecord methods

Browse Source 
`find_by!`, `find_or_create_by`, `find_or_create_by!` and
`find_or_initialize_by` act similarly to `find_by`.
This commit is contained in:
Harry Maclean
2021-09-29 10:49:14 +01:00
parent 56919eee0b
commit 270d13e4ac
3 changed files with 19 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
View File

@@ -68,7 +68,8 @@ private Expr sqlFragmentArgument(MethodCall call) {
(
methodName =
[
"delete_by", "destroy_by", "exists?", "find_by", "find_by_sql", "from", "group", "having",
"delete_by", "destroy_by", "exists?", "find_by", "find_by!", "find_or_create_by",
"find_or_create_by!", "find_or_initialize_by", "find_by_sql", "from", "group", "having",
"joins", "lock", "not", "order", "pluck", "where"
] and
result = call.getArgument(0)