Harry Maclean
|
56919eee0b
|
delete/destroy_all -> delete/destroy_by
The ActiveRecord `delete_all` and `destroy_all` methods do not take a
condition argument - they act on the scope of their receiver.
The `delete_by` and `destroy_by` methods do take an argument which can
be raw SQL, and are therefore vulnerable to SQL injection.
For more info:
https://api.rubyonrails.org/v6.1.4/classes/ActiveRecord/Relation.html#method-i-delete_all
https://api.rubyonrails.org/v6.1.4/classes/ActiveRecord/Relation.html#method-i-delete_by
|
2021-09-29 10:45:54 +01:00 |
|
Alex Ford
|
3f76075fe6
|
improve some rails framework tests
|
2021-06-29 13:56:28 +01:00 |
|
Alex Ford
|
214532516b
|
try to avoid a future merge conflict
|
2021-06-17 14:41:51 +01:00 |
|
Alex Ford
|
bf43a77df5
|
Include some more types of expressions as possible active record SQL sink arguments
|
2021-06-15 12:41:42 +01:00 |
|
Alex Ford
|
c1b9952517
|
account for chained method calls when constructing ActiveRecord SQL queries
|
2021-06-15 11:39:48 +01:00 |
|
Alex Ford
|
2d4bb61789
|
limit SqlExecutingMethodCall to those that are called with a StringlikeLiteral argument
|
2021-06-15 11:39:48 +01:00 |
|
Alex Ford
|
c641d12259
|
add shell ActiveRecord library tests
|
2021-06-15 11:39:48 +01:00 |
|