Skip to content

Commit

Permalink
Additional test for enums
Browse files Browse the repository at this point in the history
  • Loading branch information
presidentbeef committed Jul 16, 2021
1 parent e44ae9a commit 1920a23
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 3 deletions.
4 changes: 2 additions & 2 deletions test/apps/rails6/app/models/group.rb
@@ -1,6 +1,4 @@
class Group < ApplicationRecord
enum status: { start: 0, stop: 2, in_process: 3 }

def uuid_in_sql
ActiveRecord::Base.connection.exec_query("select * where x = #{User.uuid}")
end
Expand Down Expand Up @@ -30,6 +28,8 @@ def self.simple_method
"Hello"
end

enum status: { start: 0, stop: 2, in_process: 3 }

def use_enum
# No warning
self.where("thing IN #{Group.statuses.values_at(*[:start, :stop]).join(',')}")
Expand Down
14 changes: 13 additions & 1 deletion test/tests/rails6.rb
Expand Up @@ -186,7 +186,6 @@ def test_sql_injection_with_date
:user_input => s(:call, s(:call, s(:const, :Date), :today), :-, s(:lit, 1))
end

<<<<<<< HEAD
def test_sql_injection_rewhere
assert_warning :type => :warning,
:warning_code => 0,
Expand Down Expand Up @@ -268,6 +267,19 @@ def test_sql_injection_enum
:user_input => s(:call, s(:call, s(:const, :User), :states), :[], s(:str, "pending"))
end

def test_dangerous_send_enum
assert_no_warning :type => :warning,
:warning_code => 23,
:fingerprint => "483fa36e41f5791e86f345a19b517a61859886d685ce40ef852871bb7a935f2d",
:warning_type => "Dangerous Send",
:line => 78,
:message => /^User\ controlled\ method\ execution/,
:confidence => 0,
:relative_path => "app/controllers/groups_controller.rb",
:code => s(:call, s(:const, :Group), :send, s(:call, s(:dstr, "", s(:evstr, s(:call, s(:params), :[], s(:lit, :status)))), :to_sym)),
:user_input => s(:call, s(:params), :[], s(:lit, :status))
end

def test_cross_site_scripting_sanity
assert_warning :type => :template,
:warning_code => 2,
Expand Down

0 comments on commit 1920a23

Please sign in to comment.