Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 870c6d7

Browse files
hmachmac
committed
Ruby: Rails route resolution
Add `Route` classes which model Rails routing information, typically defined in a `routes.rb` file. We extract only the most basic information: HTTP method, path, controller and action. This is enough to determine whether a given controller method is a route handler, and what HTTP method it handles, which is useful for, among other things, the URL redirect query.
1 parent e622e51 commit 870c6d7

11 files changed

Lines changed: 886 additions & 0 deletions

File tree

‎ruby/ql/lib/codeql/ruby/Frameworks.qll‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,4 @@ private import codeql.ruby.frameworks.StandardLibrary
1212
private import codeql.ruby.frameworks.Files
1313
private import codeql.ruby.frameworks.HttpClients
1414
private import codeql.ruby.frameworks.XmlParsing
15+
private import codeql.ruby.frameworks.ActionDispatch

‎ruby/ql/lib/codeql/ruby/frameworks/ActionController.qll‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ private import codeql.ruby.DataFlow
55
private import codeql.ruby.dataflow.RemoteFlowSources
66
private import codeql.ruby.ast.internal.Module
77
private import ActionView
8+
private import codeql.ruby.frameworks.ActionDispatch
89

910
private class ActionControllerBaseAccess extends ConstantReadAccess {
1011
ActionControllerBaseAccess() {
@@ -85,6 +86,16 @@ class ActionControllerActionMethod extends Method, HTTP::Server::RequestHandler:
8586
// not end at an explicit render or redirect
8687
/** Gets the controller class containing this method. */
8788
ActionControllerControllerClass getControllerClass() { result = controllerClass }
89+
90+
/**
91+
* Gets a route to this handler, if one exists.
92+
* May return multiple results.
93+
*/
94+
ActionDispatch::Route getARoute() {
95+
result.getController() + "_controller" =
96+
ActionDispatch::underscore(namespaceDeclaration(controllerClass)) and
97+
this.getName() = result.getAction()
98+
}
8899
}
89100

90101
// A method call with a `self` receiver from within a controller class

0 commit comments

Comments
 (0)