Skip to content

Commit

Permalink
Additional test for enums
Browse files Browse the repository at this point in the history
  • Loading branch information
presidentbeef committed Jul 13, 2021
1 parent e6bfad9 commit 5d26917
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 2 deletions.
4 changes: 2 additions & 2 deletions test/apps/rails6/app/models/group.rb
@@ -1,6 +1,4 @@
class Group < ApplicationRecord
enum status: { start: 0, stop: 2, in_process: 3 }

def uuid_in_sql
ActiveRecord::Base.connection.exec_query("select * where x = #{User.uuid}")
end
Expand Down Expand Up @@ -30,6 +28,8 @@ def self.simple_method
"Hello"
end

enum status: { start: 0, stop: 2, in_process: 3 }

def use_enum
# No warning
self.where("thing IN #{Group.statuses.values_at(*[:start, :stop]).join(',')}")
Expand Down
13 changes: 13 additions & 0 deletions test/tests/rails6.rb
Expand Up @@ -199,6 +199,19 @@ def test_sql_injection_enum
:user_input => s(:call, s(:call, s(:const, :User), :states), :[], s(:str, "pending"))
end

def test_dangerous_send_enum
assert_no_warning :type => :warning,
:warning_code => 23,
:fingerprint => "483fa36e41f5791e86f345a19b517a61859886d685ce40ef852871bb7a935f2d",
:warning_type => "Dangerous Send",
:line => 70,
:message => /^User\ controlled\ method\ execution/,
:confidence => 0,
:relative_path => "app/controllers/groups_controller.rb",
:code => s(:call, s(:const, :Group), :send, s(:call, s(:dstr, "", s(:evstr, s(:call, s(:params), :[], s(:lit, :status)))), :to_sym)),
:user_input => s(:call, s(:params), :[], s(:lit, :status))
end

def test_cross_site_scripting_sanity
assert_warning :type => :template,
:warning_code => 2,
Expand Down

0 comments on commit 5d26917

Please sign in to comment.