hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-29 02:35:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

limit SqlExecutingMethodCall to those that are called with a StringlikeLiteral argument

Browse Source
This commit is contained in:
Alex Ford
2021-06-04 16:01:41 +01:00
parent 2c15b60998
commit 2d4bb61789
2 changed files with 17 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ql/test/library-tests/frameworks/ActiveRecordInjection.rb
View File

@@ -11,6 +11,8 @@ end
class FooController < ApplicationController
MAX_USER_ID = 100_000
# A string tainted by user input is inserted into an SQL query
def some_request_handler
# SELECT AVG(#{params[:column]}) FROM "users"
@@ -21,5 +23,10 @@ class FooController < ApplicationController
# SELECT "users".* FROM "users" WHERE (id = #{params[:id]})
User.destroy_all(["id = #{params[:id]}"])
# SELECT "users".* FROM "users" WHERE id BETWEEN #{params[:min_id]} AND 100000
User.where(<<-SQL, MAX_USER_ID)
id BETWEEN #{params[:min_id]} AND ?
SQL
end
end