Contents

require 'railroader/checks/base_check'

# Checks for unscoped calls to models' #find and #find_by_id methods.
class Railroader::CheckUnscopedFind < Railroader::BaseCheck
  Railroader::Checks.add_optional self

  @description = "Check for unscoped ActiveRecord queries"

  def run_check
    Railroader.debug("Finding instances of #find on models with associations")

    associated_model_names = active_record_models.keys.select do |name|
      if belongs_to = active_record_models[name].associations[:belongs_to]
        not optional_belongs_to? belongs_to
      else
        false
      end
    end

    calls = tracker.find_call :method => [:find, :find_by_id, :find_by_id!],
                              :targets => associated_model_names

    calls.each do |call|
      process_result call
    end
  end

  def process_result result
    return if duplicate? result or result[:call].original_line

    # Not interested unless argument is user controlled.
    inputs = result[:call].args.map { |arg| include_user_input?(arg) }
    return unless input = inputs.compact.first

    add_result result

    warn :result => result,
      :warning_type => "Unscoped Find",
      :warning_code => :unscoped_find,
      :message      => "Unscoped call to #{result[:target]}##{result[:method]}",
      :code         => result[:call],
      :confidence   => :weak,
      :user_input   => input
  end

  def optional_belongs_to? exp
    return false unless exp.is_a? Array

    exp.each do |e|
      if hash? e and true? hash_access(e, :optional)
        return true
      end
    end

    false
  end
end

Version data entries

4 entries across 4 versions & 1 rubygems

Version	Path
railroader-4.3.8	lib/railroader/checks/check_unscoped_find.rb
railroader-4.3.7	lib/railroader/checks/check_unscoped_find.rb
railroader-4.3.5	lib/railroader/checks/check_unscoped_find.rb
railroader-4.3.4	lib/railroader/checks/check_unscoped_find.rb