Tidy up PotentiallyUnsafeSqlExecutingMethodCall characteristic predicate

alexrford · nickrolfe · web-flow · commit 12a0af1d28ef · 2021-06-17T14:39:40.000+01:00
Co-authored-by: Nick Rolfe &lt;nickrolfe@github.com&gt;
diff --git a/ql/src/codeql_ruby/frameworks/ActiveRecord.qll b/ql/src/codeql_ruby/frameworks/ActiveRecord.qll
@@ -53,12 +53,15 @@ class ActiveRecordModelClassMethodCall extends MethodCall {
   }
 }
 
-private predicate methodCanTakeSqlFragmentAsFirstArg(string methodName) {
+private predicate methodWithSqlFragmentArg(string methodName, int argIndex) {
   methodName =
     [
       "delete_all", "destroy_all", "exists?", "find_by", "find_by_sql", "from", "group", "having",
       "joins", "lock", "not", "order", "pluck", "where"
-    ]
+    ] and
+  argIndex = 0
+  or
+  methodName = "calculate" and argIndex = 1
 }
 
 class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMethodCall {
@@ -73,12 +76,7 @@ class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMeth
   PotentiallyUnsafeSqlExecutingMethodCall() {
     methodName = this.getMethodName() and
     sqlFragmentExpr = this.getArgument(sqlFragmentArgumentIndex) and
-    (
-      methodName = "calculate" and sqlFragmentArgumentIndex = 1
-      or
-      sqlFragmentArgumentIndex = 0 and
-      methodCanTakeSqlFragmentAsFirstArg(methodName)
-    ) and
+    methodWithSqlFragmentArg(methodName, sqlFragmentArgumentIndex) and
     (
       // select only literals containing an interpolated value...
       exists(StringInterpolationComponent interpolated |

Original file line number	Diff line number	Diff line change
`@@ -53,12 +53,15 @@ class ActiveRecordModelClassMethodCall extends MethodCall {`
`53`	`53`	`}`
`54`	`54`	`}`
`55`	`55`
`56`		`-private predicate methodCanTakeSqlFragmentAsFirstArg(string methodName) {`
	`56`	`+private predicate methodWithSqlFragmentArg(string methodName, int argIndex) {`
`57`	`57`	`methodName =`
`58`	`58`	`[`
`59`	`59`	`"delete_all", "destroy_all", "exists?", "find_by", "find_by_sql", "from", "group", "having",`
`60`	`60`	`"joins", "lock", "not", "order", "pluck", "where"`
`61`		`- ]`
	`61`	`+ ] and`
	`62`	`+ argIndex = 0`
	`63`	`+ or`
	`64`	`+ methodName = "calculate" and argIndex = 1`
`62`	`65`	`}`
`63`	`66`
`64`	`67`	`class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMethodCall {`
`@@ -73,12 +76,7 @@ class PotentiallyUnsafeSqlExecutingMethodCall extends ActiveRecordModelClassMeth`
`73`	`76`	`PotentiallyUnsafeSqlExecutingMethodCall() {`
`74`	`77`	`methodName = this.getMethodName() and`
`75`	`78`	`sqlFragmentExpr = this.getArgument(sqlFragmentArgumentIndex) and`
`76`		`- (`
`77`		`- methodName = "calculate" and sqlFragmentArgumentIndex = 1`
`78`		`- or`
`79`		`- sqlFragmentArgumentIndex = 0 and`
`80`		`- methodCanTakeSqlFragmentAsFirstArg(methodName)`
`81`		`- ) and`
	`79`	`+ methodWithSqlFragmentArg(methodName, sqlFragmentArgumentIndex) and`
`82`	`80`	`(`
`83`	`81`	`// select only literals containing an interpolated value...`
`84`	`82`	`exists(StringInterpolationComponent interpolated \|`