Skip to content

Commit 92bdd63

Browse files
Address reveiw comment - add create nd remove select_insert
1 parent e36b9f4 commit 92bdd63

File tree

3 files changed

+6
-6
lines changed

3 files changed

+6
-6
lines changed

ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -203,9 +203,9 @@ private predicate sqlFragmentArgumentInner(DataFlow::CallNode call, DataFlow::No
203203
call =
204204
activeRecordConnectionInstance()
205205
.getAMethodCall([
206-
"delete", "exec_query", "exec_delete", "exec_insert", "exec_update", "execute",
207-
"insert", "select_all", "select_one", "select_rows", "select_value", "select_values",
208-
"select_update", "update"
206+
"create", "delete", "exec_query", "exec_delete", "exec_insert", "exec_update",
207+
"execute", "insert", "select_all", "select_one", "select_rows", "select_value",
208+
"select_values", "update"
209209
]) and
210210
sink = call.getArgument(0)
211211
or

ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.expected

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,8 +122,8 @@ activeRecordInstances
122122
activeRecordSqlExecutionRanges
123123
| ActiveRecord.rb:9:33:9:67 | "name='#{...}' and pass='#{...}'" |
124124
| ActiveRecord.rb:17:23:17:23 | q |
125-
| ActiveRecord.rb:18:27:18:27 | q |
126-
| ActiveRecord.rb:19:28:19:28 | q |
125+
| ActiveRecord.rb:18:23:18:23 | q |
126+
| ActiveRecord.rb:19:27:19:27 | q |
127127
| ActiveRecord.rb:20:28:20:28 | q |
128128
| ActiveRecord.rb:21:28:21:28 | q |
129129
| ActiveRecord.rb:22:28:22:28 | q |

ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,12 @@ def self.from(user_group_id)
1414
end
1515

1616
def exec(q)
17+
connection.create(q)
1718
connection.delete(q)
1819
connection.exec_query(q)
1920
connection.exec_insert(q)
2021
connection.exec_delete(q)
2122
connection.exec_update(q)
22-
connection.exec_insert(q)
2323
connection.execute(q)
2424
connection.insert(q)
2525
connection.select_all(q)

0 commit comments

Comments
 (0)