Class: Spektr::Checks::DynamicFinders

Inherits:
Base
  • Object
show all
Defined in:
lib/spektr/checks/dynamic_finders.rb

Instance Attribute Summary

Attributes inherited from Base

#name

Instance Method Summary collapse

Methods inherited from Base

#app_version_between?, #dupe?, #model_attribute?, #should_run?, #target_affected?, #user_input?, #version_affected, #version_between?, #warn!

Constructor Details

#initialize(app, target) ⇒ DynamicFinders

Returns a new instance of DynamicFinders.



5
6
7
8
9
10
 
# File 'lib/spektr/checks/dynamic_finders.rb', line 5

def initialize(app, target)
  super
  @name = "SQL Injection by unsafe usage of find_by_*"
  @type = "SQL Injection"
  @targets = ["Spektr::Targets::Base", "Spektr::Targets::Controller", "Spektr::Targets::View"]
end

Instance Method Details

#run ⇒ Object 



12
13
14
15
16
17
18
19
20
21
22
23
 
# File 'lib/spektr/checks/dynamic_finders.rb', line 12

def run
  return unless super
  if app_version_between?("2.0.0", "4.1.99") && @app.has_gem?("mysql")
    @target.find_calls(/^find_by_/).each do |call|
      call.arguments.each do |argument|
        if user_input?(argument.type, argument.name, argument.ast)
          warn! @target, self, call.location, "MySQL integer conversion may cause 0 to match any string"
        end
      end
    end
  end
end