Sha256: a98f710fbc90c73f8a3b28fa481ceea290c9ec231355224438dad7de3a1f9b45
Contents?: true
Size: 1.55 KB
Versions: 12
Compression:
Stored size: 1.55 KB
Contents
require 'brakeman/checks/base_check'
# Checks for unscoped calls to models' #find and #find_by_id methods.
class Brakeman::CheckUnscopedFind < Brakeman::BaseCheck
Brakeman::Checks.add_optional self
@description = "Check for unscoped ActiveRecord queries"
def run_check
Brakeman.debug("Finding instances of #find on models with associations")
associated_model_names = active_record_models.keys.select do |name|
if belongs_to = active_record_models[name].associations[:belongs_to]
not optional_belongs_to? belongs_to
else
false
end
end
calls = tracker.find_call :method => [:find, :find_by_id, :find_by_id!],
:targets => associated_model_names
calls.each do |call|
process_result call
end
end
def process_result result
return if duplicate? result or result[:call].original_line
# Not interested unless argument is user controlled.
inputs = result[:call].args.map { |arg| include_user_input?(arg) }
return unless input = inputs.compact.first
add_result result
warn :result => result,
:warning_type => "Unscoped Find",
:warning_code => :unscoped_find,
:message => "Unscoped call to #{result[:target]}##{result[:method]}",
:code => result[:call],
:confidence => :weak,
:user_input => input
end
def optional_belongs_to? exp
return false unless exp.is_a? Array
exp.each do |e|
if hash? e and true? hash_access(e, :optional)
return true
end
end
false
end
end
Version data entries
12 entries across 12 versions & 3 rubygems