Skip to content

Commit 37eb810

Browse files
Add additional sinks for connection methods
1 parent cd00a4d commit 37eb810

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -200,7 +200,13 @@ private predicate sqlFragmentArgumentInner(DataFlow::CallNode call, DataFlow::No
200200
call = activeRecordQueryBuilderCall("annotate") and
201201
sink = call.getArgument(_)
202202
or
203-
call = activeRecordConnectionInstance().getAMethodCall("execute") and
203+
call =
204+
activeRecordConnectionInstance()
205+
.getAMethodCall([
206+
"delete", "exec_query", "exec_delete", "exec_insert", "exec_update", "execute",
207+
"insert", "select_all", "select_one", "select_rows", "select_value", "select_values",
208+
"select_update", "update"
209+
]) and
204210
sink = call.getArgument(0)
205211
or
206212
call = activeRecordQueryBuilderCall("update_all") and

0 commit comments

Comments
 (0)