hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-26 17:25:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Address reveiw comment - add create nd remove select_insert

Browse Source
This commit is contained in:
Joe Farebrother
2024-02-22 09:55:46 +00:00
parent e36b9f4d3c
commit 92bdd637a3
3 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll
View File

@@ -203,9 +203,9 @@ private predicate sqlFragmentArgumentInner(DataFlow::CallNode call, DataFlow::No
call =
activeRecordConnectionInstance()
.getAMethodCall([
"delete", "exec_query", "exec_delete", "exec_insert", "exec_update", "execute",
"insert", "select_all", "select_one", "select_rows", "select_value", "select_values",
"select_update", "update"
"create", "delete", "exec_query", "exec_delete", "exec_insert", "exec_update",
"execute", "insert", "select_all", "select_one", "select_rows", "select_value",
"select_values", "update"
]) and
sink = call.getArgument(0)
or

4
ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.expected
View File

@@ -122,8 +122,8 @@ activeRecordInstances
activeRecordSqlExecutionRanges
| ActiveRecord.rb:9:33:9:67 | "name='#{...}' and pass='#{...}'" |
| ActiveRecord.rb:17:23:17:23 | q |
| ActiveRecord.rb:18:27:18:27 | q |
| ActiveRecord.rb:19:28:19:28 | q |
| ActiveRecord.rb:18:23:18:23 | q |
| ActiveRecord.rb:19:27:19:27 | q |
| ActiveRecord.rb:20:28:20:28 | q |
| ActiveRecord.rb:21:28:21:28 | q |
| ActiveRecord.rb:22:28:22:28 | q |

2
ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.rb
View File

@@ -14,12 +14,12 @@ class User < ApplicationRecord
end
def exec(q)
connection.create(q)
connection.delete(q)
connection.exec_query(q)
connection.exec_insert(q)
connection.exec_delete(q)
connection.exec_update(q)
connection.exec_insert(q)
connection.execute(q)
connection.insert(q)
connection.select_all(q)