add ActiveRecord find_by_sql as an SQL executing method call

2026-04-26 01:05:15 +02:00 · 2021-06-04 13:31:21 +01:00
parent c641d12259
commit 2c15b60998
1 changed files with 2 additions and 0 deletions
--- a/ql/src/codeql_ruby/frameworks/ActiveRecord.qll
+++ b/ql/src/codeql_ruby/frameworks/ActiveRecord.qll
@@ -67,6 +67,8 @@ class SqlExecutingMethodCall extends ActiveRecordModelClassMethodCall {
        or
        methodName = "find_by"
        or
+        methodName = "find_by_sql"
+        or
        methodName = "from"
        or
        methodName = "group"