Skip to content

Commit d628716

Browse files
alexrfordalexrford
committed
extend ActionController tests
1 parent 41ff10c commit d628716

4 files changed

Lines changed: 69 additions & 15 deletions

File tree

‎ql/src/codeql_ruby/frameworks/ActionController.qll‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -127,12 +127,17 @@ class ParamsSource extends RemoteFlowSource::Range {
127127
// A call to `params` from within a controller.
128128
private class ActionControllerParamsCall extends ActionControllerContextCall, ParamsCall { }
129129

130+
// A call to `render` from within a controller.
131+
private class ActionControllerRenderCall extends ActionControllerContextCall, RenderCall { }
132+
130133
// A call to `render_to` from within a controller.
131134
private class ActionControllerRenderToCall extends ActionControllerContextCall, RenderToCall { }
132135

133136
// A call to `html_safe` from within a controller.
134137
private class ActionControllerHtmlSafeCall extends HtmlSafeCall {
135-
ActionControllerHtmlSafeCall() { this.getEnclosingModule() instanceof ActionControllerControllerClass }
138+
ActionControllerHtmlSafeCall() {
139+
this.getEnclosingModule() instanceof ActionControllerControllerClass
140+
}
136141
}
137142

138143
/**
@@ -155,13 +160,6 @@ class RedirectToCall extends ActionControllerContextCall {
155160
}
156161
}
157162

158-
/**
159-
* A `SetterMethodCall` that assigns a value to the `response_body`.
160-
*/
161-
class ResponseBodySetterCall extends SetterMethodCall {
162-
ResponseBodySetterCall() { this.getMethodName() = "response_body=" }
163-
}
164-
165163
/**
166164
* A method in an `ActionController` class that is accessible from within a view as a helper method.
167165
*/
@@ -180,3 +178,16 @@ class ActionControllerHelperMethod extends Method {
180178
/** Gets the class containing this helper method. */
181179
ActionControllerControllerClass getControllerClass() { result = controllerClass }
182180
}
181+
182+
/**
183+
* Gets an `ActionControllerControllerClass` associated with the given `ErbFile`
184+
* according to Rails path conventions.
185+
*/
186+
ActionControllerControllerClass getAssociatedControllerClass(ErbFile f) {
187+
exists(string localPrefix, string sourcePrefix, string controllerPath |
188+
controllerPath = result.getLocation().getFile().getAbsolutePath() and
189+
sourcePrefix = f.getAbsolutePath().regexpCapture("^(.*)/app/views/(?:.*?)/(?:[^/]*)$", 1) and
190+
localPrefix = f.getAbsolutePath().regexpCapture(".*/app/views/(.*?)/(?:[^/]*)$", 1) and
191+
controllerPath = sourcePrefix + "/app/controllers/" + localPrefix + "_controller.rb"
192+
)
193+
}

‎ql/src/codeql_ruby/frameworks/ActionView.qll‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -43,16 +43,14 @@ class RawCall extends ActionViewContextCall {
4343
RawCall() { this.getMethodName() = "raw" }
4444
}
4545

46-
/**
47-
* A call to the `params` method within the context of a template or view component.
48-
*/
46+
// A call to the `params` method within the context of a template or view component.
4947
private class ActionViewParamsCall extends ActionViewContextCall, ParamsCall { }
5048

5149
/**
5250
* A call to a `render` method that will populate the response body with the
5351
* rendered content.
5452
*/
55-
class RenderCall extends ActionViewContextCall {
53+
abstract class RenderCall extends MethodCall {
5654
RenderCall() { this.getMethodName() = "render" }
5755

5856
private string getWorkingDirectory() {
@@ -96,7 +94,7 @@ class RenderCall extends ActionViewContextCall {
9694
/**
9795
* Get the template file to be rendered by this call, if any.
9896
*/
99-
ErbFile getTemplate() { result.getAbsolutePath().matches(this.getTemplatePathPatterns()) }
97+
ErbFile getTemplateFile() { result.getAbsolutePath().matches(this.getTemplatePathPatterns()) }
10098

10199
/**
102100
* Get the local variables passed as context to the renderer
@@ -105,6 +103,9 @@ class RenderCall extends ActionViewContextCall {
105103
// TODO: implicit renders in controller actions
106104
}
107105

106+
// A call to the `render` method within the context of a template or view component.
107+
private class ActionViewRenderCall extends RenderCall, ActionViewContextCall { }
108+
108109
/**
109110
* A render call that does not automatically set the HTTP response body.
110111
*/

‎ql/test/library-tests/frameworks/ActionController.expected‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,40 @@
1+
actionControllerControllerClasses
12
| ActiveRecordInjection.rb:27:1:58:3 | FooController |
23
| ActiveRecordInjection.rb:60:1:90:3 | BarController |
34
| ActiveRecordInjection.rb:92:1:96:3 | BazController |
5+
actionControllerActionMethods
6+
| ActiveRecordInjection.rb:32:3:57:5 | some_request_handler |
7+
| ActiveRecordInjection.rb:61:3:69:5 | some_other_request_handler |
8+
| ActiveRecordInjection.rb:71:3:89:5 | safe_paths |
9+
| ActiveRecordInjection.rb:93:3:95:5 | yet_another_handler |
10+
paramsCalls
11+
| ActiveRecordInjection.rb:35:30:35:35 | call to params |
12+
| ActiveRecordInjection.rb:39:30:39:35 | call to params |
13+
| ActiveRecordInjection.rb:43:32:43:37 | call to params |
14+
| ActiveRecordInjection.rb:48:21:48:26 | call to params |
15+
| ActiveRecordInjection.rb:54:34:54:39 | call to params |
16+
| ActiveRecordInjection.rb:56:23:56:28 | call to params |
17+
| ActiveRecordInjection.rb:56:38:56:43 | call to params |
18+
| ActiveRecordInjection.rb:62:10:62:15 | call to params |
19+
| ActiveRecordInjection.rb:72:11:72:16 | call to params |
20+
| ActiveRecordInjection.rb:77:12:77:17 | call to params |
21+
| ActiveRecordInjection.rb:83:12:83:17 | call to params |
22+
| ActiveRecordInjection.rb:88:15:88:20 | call to params |
23+
| ActiveRecordInjection.rb:94:22:94:27 | call to params |
24+
paramsSources
25+
| ActiveRecordInjection.rb:35:30:35:35 | call to params |
26+
| ActiveRecordInjection.rb:39:30:39:35 | call to params |
27+
| ActiveRecordInjection.rb:43:32:43:37 | call to params |
28+
| ActiveRecordInjection.rb:48:21:48:26 | call to params |
29+
| ActiveRecordInjection.rb:54:34:54:39 | call to params |
30+
| ActiveRecordInjection.rb:56:23:56:28 | call to params |
31+
| ActiveRecordInjection.rb:56:38:56:43 | call to params |
32+
| ActiveRecordInjection.rb:62:10:62:15 | call to params |
33+
| ActiveRecordInjection.rb:72:11:72:16 | call to params |
34+
| ActiveRecordInjection.rb:77:12:77:17 | call to params |
35+
| ActiveRecordInjection.rb:83:12:83:17 | call to params |
36+
| ActiveRecordInjection.rb:88:15:88:20 | call to params |
37+
| ActiveRecordInjection.rb:94:22:94:27 | call to params |
38+
redirectToCalls
39+
responseBodySetterCalls
40+
actionControllerHelperMethods

‎ql/test/library-tests/frameworks/ActionController.ql‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
1-
import codeql_ruby.controlflow.CfgNodes
21
import codeql_ruby.frameworks.ActionController
32

4-
query predicate actionControllerControllerClasses(ActionControllerControllerClass cls) { any() }
3+
query predicate actionControllerControllerClasses(ActionControllerControllerClass cls) { any() }
4+
query predicate actionControllerActionMethods(ActionControllerActionMethod m) { any() }
5+
query predicate paramsCalls(ParamsCall c) { any() }
6+
query predicate paramsSources(ParamsSource src) { any() }
7+
query predicate redirectToCalls(RedirectToCall c) { any() }
8+
query predicate responseBodySetterCalls(ResponseBodySetterCall c) { any() }
9+
query predicate actionControllerHelperMethods(ActionControllerHelperMethod m) { any() }

0 commit comments

Comments
 (0)