Skip to content

Commit e403fc7

Browse files
alexrfordalexrford
committed
tests
1 parent d628716 commit e403fc7

8 files changed

Lines changed: 127 additions & 4 deletions

File tree

‎ql/test/library-tests/frameworks/ActionController.expected‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,15 @@ actionControllerControllerClasses
22
| ActiveRecordInjection.rb:27:1:58:3 | FooController |
33
| ActiveRecordInjection.rb:60:1:90:3 | BarController |
44
| ActiveRecordInjection.rb:92:1:96:3 | BazController |
5+
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController |
56
actionControllerActionMethods
67
| ActiveRecordInjection.rb:32:3:57:5 | some_request_handler |
78
| ActiveRecordInjection.rb:61:3:69:5 | some_other_request_handler |
89
| ActiveRecordInjection.rb:71:3:89:5 | safe_paths |
910
| ActiveRecordInjection.rb:93:3:95:5 | yet_another_handler |
11+
| app/controllers/foo/bars_controller.rb:3:3:5:5 | index |
12+
| app/controllers/foo/bars_controller.rb:7:3:13:5 | show_debug |
13+
| app/controllers/foo/bars_controller.rb:15:3:19:5 | show |
1014
paramsCalls
1115
| ActiveRecordInjection.rb:35:30:35:35 | call to params |
1216
| ActiveRecordInjection.rb:39:30:39:35 | call to params |
@@ -21,6 +25,11 @@ paramsCalls
2125
| ActiveRecordInjection.rb:83:12:83:17 | call to params |
2226
| ActiveRecordInjection.rb:88:15:88:20 | call to params |
2327
| ActiveRecordInjection.rb:94:22:94:27 | call to params |
28+
| app/controllers/foo/bars_controller.rb:8:21:8:26 | call to params |
29+
| app/controllers/foo/bars_controller.rb:9:10:9:15 | call to params |
30+
| app/controllers/foo/bars_controller.rb:16:21:16:26 | call to params |
31+
| app/controllers/foo/bars_controller.rb:17:10:17:15 | call to params |
32+
| app/views/foo/bars/show.html.erb:5:9:5:14 | call to params |
2433
paramsSources
2534
| ActiveRecordInjection.rb:35:30:35:35 | call to params |
2635
| ActiveRecordInjection.rb:39:30:39:35 | call to params |
@@ -35,6 +44,14 @@ paramsSources
3544
| ActiveRecordInjection.rb:83:12:83:17 | call to params |
3645
| ActiveRecordInjection.rb:88:15:88:20 | call to params |
3746
| ActiveRecordInjection.rb:94:22:94:27 | call to params |
47+
| app/controllers/foo/bars_controller.rb:8:21:8:26 | call to params |
48+
| app/controllers/foo/bars_controller.rb:9:10:9:15 | call to params |
49+
| app/controllers/foo/bars_controller.rb:16:21:16:26 | call to params |
50+
| app/controllers/foo/bars_controller.rb:17:10:17:15 | call to params |
51+
| app/views/foo/bars/show.html.erb:5:9:5:14 | call to params |
3852
redirectToCalls
39-
responseBodySetterCalls
53+
| app/controllers/foo/bars_controller.rb:12:5:12:30 | call to redirect_to |
4054
actionControllerHelperMethods
55+
getAssociatedControllerClasses
56+
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController | app/views/foo/bars/_widget.html.erb:0:0:0:0 | app/views/foo/bars/_widget.html.erb |
57+
| app/controllers/foo/bars_controller.rb:1:1:20:3 | BarsController | app/views/foo/bars/show.html.erb:0:0:0:0 | app/views/foo/bars/show.html.erb |

‎ql/test/library-tests/frameworks/ActionController.ql‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,19 @@
1-
import codeql_ruby.frameworks.ActionController
1+
private import ruby
2+
private import codeql_ruby.frameworks.ActionController
3+
private import codeql_ruby.frameworks.ActionView
24

35
query predicate actionControllerControllerClasses(ActionControllerControllerClass cls) { any() }
6+
47
query predicate actionControllerActionMethods(ActionControllerActionMethod m) { any() }
8+
59
query predicate paramsCalls(ParamsCall c) { any() }
10+
611
query predicate paramsSources(ParamsSource src) { any() }
12+
713
query predicate redirectToCalls(RedirectToCall c) { any() }
8-
query predicate responseBodySetterCalls(ResponseBodySetterCall c) { any() }
9-
query predicate actionControllerHelperMethods(ActionControllerHelperMethod m) { any() }
14+
15+
query predicate actionControllerHelperMethods(ActionControllerHelperMethod m) { any() }
16+
17+
query predicate getAssociatedControllerClasses(ActionControllerControllerClass cls, ErbFile f) {
18+
cls = getAssociatedControllerClass(f)
19+
}

‎ql/test/library-tests/frameworks/ActionView.expected‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
htmlSafeCalls
2+
| app/views/foo/bars/show.html.erb:23:3:23:25 | call to html_safe |
3+
| app/views/foo/bars/show.html.erb:27:3:27:25 | call to html_safe |
4+
rawCalls
5+
| app/views/foo/bars/_widget.html.erb:1:5:1:21 | call to raw |
6+
| app/views/foo/bars/_widget.html.erb:2:5:2:20 | call to raw |
7+
| app/views/foo/bars/_widget.html.erb:3:5:3:29 | call to raw |
8+
| app/views/foo/bars/show.html.erb:1:14:1:29 | call to raw |
9+
| app/views/foo/bars/show.html.erb:2:5:2:21 | call to raw |
10+
| app/views/foo/bars/show.html.erb:3:5:3:20 | call to raw |
11+
| app/views/foo/bars/show.html.erb:4:5:4:29 | call to raw |
12+
| app/views/foo/bars/show.html.erb:5:5:5:21 | call to raw |
13+
| app/views/foo/bars/show.html.erb:7:5:7:19 | call to raw |
14+
renderCalls
15+
| app/controllers/foo/bars_controller.rb:4:5:4:37 | call to render |
16+
| app/controllers/foo/bars_controller.rb:18:5:18:76 | call to render |
17+
| app/views/foo/bars/show.html.erb:31:5:31:89 | call to render |
18+
renderToCalls
19+
| app/controllers/foo/bars_controller.rb:10:16:10:97 | call to render_to_string |
20+
viewComponentClasses
21+
| app/components/DummyComponent.rb:1:1:2:3 | DummyComponent |
22+
linkToCalls
23+
| app/views/foo/bars/show.html.erb:33:5:33:41 | call to link_to |

‎ql/test/library-tests/frameworks/ActionView.ql‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
import codeql_ruby.frameworks.ActionController
2+
import codeql_ruby.frameworks.ActionView
3+
4+
query predicate htmlSafeCalls(HtmlSafeCall c) { any() }
5+
6+
query predicate rawCalls(RawCall c) { any() }
7+
8+
query predicate renderCalls(RenderCall c) { any() }
9+
10+
query predicate renderToCalls(RenderToCall c) { any() }
11+
12+
query predicate viewComponentClasses(ViewComponentClass cls) { any() }
13+
14+
query predicate linkToCalls(LinkToCall c) { any() }

‎ql/test/library-tests/frameworks/app/components/DummyComponent.rb‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
class DummyComponent < ViewComponent::Base
2+
end

‎ql/test/library-tests/frameworks/app/controllers/foo/bars_controller.rb‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
class BarsController < ApplicationController
2+
3+
def index
4+
render template: "foo/bars/index"
5+
end
6+
7+
def show_debug
8+
@user_website = params[:website]
9+
dt = params[:text]
10+
rendered = render_to_string "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }
11+
puts rendered
12+
redirect_to action: "show"
13+
end
14+
15+
def show
16+
@user_website = params[:website]
17+
dt = params[:text]
18+
render "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }
19+
end
20+
end

‎ql/test/library-tests/frameworks/app/views/foo/bars/_widget.html.erb‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
<%= raw @display_text %>
2+
<%= raw display_text %>
3+
<%= raw locals[:display_text] %>
4+
<%= @display_text %>

‎ql/test/library-tests/frameworks/app/views/foo/bars/show.html.erb‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
<a href="<%= raw user_website %>">website</a>
2+
<%= raw @display_text %>
3+
<%= raw display_text %>
4+
<%= raw locals[:display_text] %>
5+
<%= raw params[:text] %>
6+
<% key = :display_text %>
7+
<%= raw locals[key] %>
8+
9+
<ul>
10+
<% key = [:display_text, :safe_text] do
11+
<li><%= raw locals[key] %></li>
12+
<% end %>
13+
</ul>
14+
15+
<%= @display_text %>
16+
17+
<%=
18+
full_text = prefix + locals[:display_text]
19+
full_text
20+
%>
21+
22+
<%=
23+
@display_text.html_safe
24+
%>
25+
26+
<%=
27+
@display_text.html_safe
28+
@display_text
29+
%>
30+
31+
<%= render partial: 'foo/bars/widget', locals: { display_text: "widget_" + display_text } %>
32+
33+
<%= link_to "some website", @user_website %>

0 commit comments

Comments
 (0)