diff --git a/test/apps/rails6/app/models/group.rb b/test/apps/rails6/app/models/group.rb index cca3b2fdb9..0ceba8ec68 100644 --- a/test/apps/rails6/app/models/group.rb +++ b/test/apps/rails6/app/models/group.rb @@ -1,6 +1,4 @@ class Group < ApplicationRecord - enum status: { start: 0, stop: 2, in_process: 3 } - def uuid_in_sql ActiveRecord::Base.connection.exec_query("select * where x = #{User.uuid}") end @@ -30,6 +28,8 @@ def self.simple_method "Hello" end + enum status: { start: 0, stop: 2, in_process: 3 } + def use_enum # No warning self.where("thing IN #{Group.statuses.values_at(*[:start, :stop]).join(',')}") diff --git a/test/tests/rails6.rb b/test/tests/rails6.rb index fd75f22508..d9fa71d263 100644 --- a/test/tests/rails6.rb +++ b/test/tests/rails6.rb @@ -186,7 +186,6 @@ def test_sql_injection_with_date :user_input => s(:call, s(:call, s(:const, :Date), :today), :-, s(:lit, 1)) end -<<<<<<< HEAD def test_sql_injection_rewhere assert_warning :type => :warning, :warning_code => 0, @@ -268,6 +267,19 @@ def test_sql_injection_enum :user_input => s(:call, s(:call, s(:const, :User), :states), :[], s(:str, "pending")) end + def test_dangerous_send_enum + assert_no_warning :type => :warning, + :warning_code => 23, + :fingerprint => "483fa36e41f5791e86f345a19b517a61859886d685ce40ef852871bb7a935f2d", + :warning_type => "Dangerous Send", + :line => 78, + :message => /^User\ controlled\ method\ execution/, + :confidence => 0, + :relative_path => "app/controllers/groups_controller.rb", + :code => s(:call, s(:const, :Group), :send, s(:call, s(:dstr, "", s(:evstr, s(:call, s(:params), :[], s(:lit, :status)))), :to_sym)), + :user_input => s(:call, s(:params), :[], s(:lit, :status)) + end + def test_cross_site_scripting_sanity assert_warning :type => :template, :warning_code => 2,