Harry Maclean
7191e1c007
Re-add delete_all and destroy_all methods
...
These methods don't take any arguments in Rails versions > 3, but
there's no harm in checking for them anyway, and some people might be
using very old Rails versions.
2021-09-30 09:39:58 +01:00
Harry Maclean
75bbc51e73
Make room for new test cases
...
This just bumps the other code down a bit so that the .expected diff is
easier to read.
2021-09-30 09:33:39 +01:00
Harry Maclean
615beeec80
Identify more vulnerable ActiveRecord methods
...
This change identifies the following patterns:
- `Model.select(input)`
- `Model.reselect(input)`
- `Model.rewhere(input)`
- `Model.update_all(input)`
- `model.reload(lock: input)`
2021-09-29 11:47:07 +01:00
Harry Maclean
270d13e4ac
Identify more vulnerable ActiveRecord methods
...
`find_by!`, `find_or_create_by`, `find_or_create_by!` and
`find_or_initialize_by` act similarly to `find_by`.
2021-09-29 10:49:14 +01:00
Harry Maclean
56919eee0b
delete/destroy_all -> delete/destroy_by
...
The ActiveRecord `delete_all` and `destroy_all` methods do not take a
condition argument - they act on the scope of their receiver.
The `delete_by` and `destroy_by` methods do take an argument which can
be raw SQL, and are therefore vulnerable to SQL injection.
For more info:
https://api.rubyonrails.org/v6.1.4/classes/ActiveRecord/Relation.html#method-i-delete_all
https://api.rubyonrails.org/v6.1.4/classes/ActiveRecord/Relation.html#method-i-delete_by
2021-09-29 10:45:54 +01:00
Harry Maclean
3a1b294c21
Identify more ActiveRecord calculate methods
...
`average`, `count`, `maximum`, `minimum` and `sum` are all convenience
methods that call `calculate(:<method name>, ...)` under the hood.
Therefore they are vulnerable to SQL injection too.
2021-09-29 10:11:38 +01:00
Tom Hvitved
9e67382f06
Bump codeql submodule
2021-09-15 14:59:42 +02:00
Harry Maclean
8f36b0d7fe
Simplify guard in SQL injection tests
...
We don't (yet) properly sanitize taint in cases like this
foo = "A" unless foo == "B"
So for now, use a simpler guard in the SQL injection test.
We can resurrect the old, more idiomatic guard when we can support it.
2021-09-10 16:27:57 +01:00
Alex Ford
31cbf818ab
fix rb/sql-injection FPs due to not accounting for overridden ActiveRecord methods
2021-06-29 13:54:15 +01:00
Alex Ford
9883a9b606
update SqlInjection tests
2021-06-24 18:12:26 +01:00
Alex Ford
d62f4f5bd4
Address review comments
2021-06-24 18:12:26 +01:00
Alex Ford
12e4c9ee90
update SqlInjection tests
2021-06-24 18:12:25 +01:00
Alex Ford
5386c776b3
Implement rb/sql-injection
2021-06-24 18:12:25 +01:00
