Harry Maclean
|
56919eee0b
|
delete/destroy_all -> delete/destroy_by
The ActiveRecord `delete_all` and `destroy_all` methods do not take a
condition argument - they act on the scope of their receiver.
The `delete_by` and `destroy_by` methods do take an argument which can
be raw SQL, and are therefore vulnerable to SQL injection.
For more info:
https://api.rubyonrails.org/v6.1.4/classes/ActiveRecord/Relation.html#method-i-delete_all
https://api.rubyonrails.org/v6.1.4/classes/ActiveRecord/Relation.html#method-i-delete_by
|
2021-09-29 10:45:54 +01:00 |
|
Alex Ford
|
3f76075fe6
|
improve some rails framework tests
|
2021-06-29 13:56:28 +01:00 |
|
Alex Ford
|
b27891b14e
|
update ActiveRecord test output
|
2021-06-24 18:12:26 +01:00 |
|
Alex Ford
|
7415503772
|
update ActiveRecord test output
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
6e5665da8c
|
Make ActiveRecord model flag more potentially dangerous SQL executions
|
2021-06-24 18:12:25 +01:00 |
|
Alex Ford
|
bf43a77df5
|
Include some more types of expressions as possible active record SQL sink arguments
|
2021-06-15 12:41:42 +01:00 |
|
Alex Ford
|
c1b9952517
|
account for chained method calls when constructing ActiveRecord SQL queries
|
2021-06-15 11:39:48 +01:00 |
|
Alex Ford
|
57c04266e3
|
rename SqlExecutingMethodCall as PotentiallyUnsafeSqlExecutingMethodCall
|
2021-06-15 11:39:48 +01:00 |
|
Alex Ford
|
c641d12259
|
add shell ActiveRecord library tests
|
2021-06-15 11:39:48 +01:00 |
|