|
5 | 5 | private import codeql.ruby.AST |
6 | 6 | private import codeql.ruby.Concepts |
7 | 7 | private import codeql.ruby.DataFlow |
8 | | -private import codeql.ruby.frameworks.ActionController |
9 | | -private import codeql.ruby.frameworks.ActionView |
10 | 8 | private import codeql.ruby.frameworks.ActiveRecord |
11 | 9 | private import codeql.ruby.frameworks.ActiveStorage |
12 | 10 | private import codeql.ruby.frameworks.internal.Rails |
13 | 11 | private import codeql.ruby.ApiGraphs |
14 | 12 | private import codeql.ruby.security.OpenSSL |
15 | 13 |
|
16 | | -/** |
17 | | - * A method call on a string to mark it as HTML safe for Rails. Strings marked |
18 | | - * as such will not be automatically escaped when inserted into HTML. |
19 | | - */ |
20 | | -class HtmlSafeCall extends MethodCall instanceof HtmlSafeCallImpl { } |
| 14 | +module Rails { |
| 15 | + /** |
| 16 | + * A method call on a string to mark it as HTML safe for Rails. Strings marked |
| 17 | + * as such will not be automatically escaped when inserted into HTML. |
| 18 | + */ |
| 19 | + class HtmlSafeCall extends MethodCall instanceof HtmlSafeCallImpl { } |
21 | 20 |
|
22 | | -/** A call to a Rails method to escape HTML. */ |
23 | | -class HtmlEscapeCall extends MethodCall instanceof HtmlEscapeCallImpl { } |
| 21 | + /** A call to a Rails method to escape HTML. */ |
| 22 | + class HtmlEscapeCall extends MethodCall instanceof HtmlEscapeCallImpl { } |
24 | 23 |
|
25 | | -/** A call to fetch the request parameters in a Rails app. */ |
26 | | -class ParamsCall extends MethodCall instanceof ParamsCallImpl { } |
| 24 | + /** A call to fetch the request parameters in a Rails app. */ |
| 25 | + class ParamsCall extends MethodCall instanceof ParamsCallImpl { } |
27 | 26 |
|
28 | | -/** A call to fetch the request cookies in a Rails app. */ |
29 | | -class CookiesCall extends MethodCall instanceof CookiesCallImpl { } |
| 27 | + /** A call to fetch the request cookies in a Rails app. */ |
| 28 | + class CookiesCall extends MethodCall instanceof CookiesCallImpl { } |
30 | 29 |
|
31 | | -/** |
32 | | - * A call to a render method that will populate the response body with the |
33 | | - * rendered content. |
34 | | - */ |
35 | | -class RenderCall extends MethodCall instanceof RenderCallImpl { |
36 | | - private Expr getTemplatePathArgument() { |
37 | | - // TODO: support other ways of specifying paths (e.g. `file`) |
38 | | - result = [this.getKeywordArgument(["partial", "template", "action"]), this.getArgument(0)] |
39 | | - } |
| 30 | + /** |
| 31 | + * A call to a render method that will populate the response body with the |
| 32 | + * rendered content. |
| 33 | + */ |
| 34 | + class RenderCall extends MethodCall instanceof RenderCallImpl { |
| 35 | + private Expr getTemplatePathArgument() { |
| 36 | + // TODO: support other ways of specifying paths (e.g. `file`) |
| 37 | + result = [this.getKeywordArgument(["partial", "template", "action"]), this.getArgument(0)] |
| 38 | + } |
40 | 39 |
|
41 | | - private string getTemplatePathValue() { |
42 | | - result = this.getTemplatePathArgument().getConstantValue().getStringlikeValue() |
43 | | - } |
| 40 | + private string getTemplatePathValue() { |
| 41 | + result = this.getTemplatePathArgument().getConstantValue().getStringlikeValue() |
| 42 | + } |
44 | 43 |
|
45 | | - // everything up to and including the final slash, but ignoring any leading slash |
46 | | - private string getSubPath() { |
47 | | - result = this.getTemplatePathValue().regexpCapture("^/?(.*/)?(?:[^/]*?)$", 1) |
48 | | - } |
| 44 | + // everything up to and including the final slash, but ignoring any leading slash |
| 45 | + private string getSubPath() { |
| 46 | + result = this.getTemplatePathValue().regexpCapture("^/?(.*/)?(?:[^/]*?)$", 1) |
| 47 | + } |
49 | 48 |
|
50 | | - // everything after the final slash, or the whole string if there is no slash |
51 | | - private string getBaseName() { |
52 | | - result = this.getTemplatePathValue().regexpCapture("^/?(?:.*/)?([^/]*?)$", 1) |
53 | | - } |
| 49 | + // everything after the final slash, or the whole string if there is no slash |
| 50 | + private string getBaseName() { |
| 51 | + result = this.getTemplatePathValue().regexpCapture("^/?(?:.*/)?([^/]*?)$", 1) |
| 52 | + } |
54 | 53 |
|
55 | | - /** |
56 | | - * Gets the template file to be rendered by this call, if any. |
57 | | - */ |
58 | | - ErbFile getTemplateFile() { |
59 | | - result.getTemplateName() = this.getBaseName() and |
60 | | - result.getRelativePath().matches("%app/views/" + this.getSubPath() + "%") |
| 54 | + /** |
| 55 | + * Gets the template file to be rendered by this call, if any. |
| 56 | + */ |
| 57 | + ErbFile getTemplateFile() { |
| 58 | + result.getTemplateName() = this.getBaseName() and |
| 59 | + result.getRelativePath().matches("%app/views/" + this.getSubPath() + "%") |
| 60 | + } |
| 61 | + |
| 62 | + /** |
| 63 | + * Get the local variables passed as context to the renderer |
| 64 | + */ |
| 65 | + HashLiteral getLocals() { result = this.getKeywordArgument("locals") } |
| 66 | + // TODO: implicit renders in controller actions |
61 | 67 | } |
62 | 68 |
|
63 | | - /** |
64 | | - * Get the local variables passed as context to the renderer |
65 | | - */ |
66 | | - HashLiteral getLocals() { result = this.getKeywordArgument("locals") } |
67 | | - // TODO: implicit renders in controller actions |
| 69 | + /** A render call that does not automatically set the HTTP response body. */ |
| 70 | + class RenderToCall extends MethodCall instanceof RenderToCallImpl { } |
68 | 71 | } |
69 | 72 |
|
70 | | -/** A render call that does not automatically set the HTTP response body. */ |
71 | | -class RenderToCall extends MethodCall instanceof RenderToCallImpl { } |
72 | | - |
73 | 73 | /** |
74 | 74 | * A reference to either `Rails::Railtie`, `Rails::Engine`, or `Rails::Application`. |
75 | 75 | * `Engine` and `Application` extend `Railtie`, but may not have definitions present in the database. |
|
0 commit comments