Ruby: Move ActionView tests into their own dir

This ensures that changes to unrelated test files don't affect these
tests.

Author: hmac

ruby/ql/test/library-tests/frameworks/ActionView.expected

@@ -1 +1,44 @@
+fileSystemResolverAccesses
 | ActionView.rb:5:39:5:92 | call to new | ActionView.rb:5:74:5:82 | view_path |
+| app/controllers/comments_controller.rb:21:5:21:37 | call to send_file | app/controllers/comments_controller.rb:21:24:21:36 | "my-file.ext" |
+| app/controllers/foo/bars_controller.rb:1:1:1:14 | call to require | app/controllers/foo/bars_controller.rb:1:9:1:14 | "json" |
+rawCalls
+| app/views/foo/bars/_widget.html.erb:1:5:1:21 | call to raw |
+| app/views/foo/bars/_widget.html.erb:2:5:2:20 | call to raw |
+| app/views/foo/bars/_widget.html.erb:3:5:3:29 | call to raw |
+| app/views/foo/bars/show.html.erb:1:14:1:29 | call to raw |
+| app/views/foo/bars/show.html.erb:2:5:2:21 | call to raw |
+| app/views/foo/bars/show.html.erb:3:5:3:20 | call to raw |
+| app/views/foo/bars/show.html.erb:4:5:4:29 | call to raw |
+| app/views/foo/bars/show.html.erb:5:5:5:21 | call to raw |
+| app/views/foo/bars/show.html.erb:7:5:7:19 | call to raw |
+renderCalls
+| app/controllers/foo/bars_controller.rb:6:5:6:37 | call to render |
+| app/controllers/foo/bars_controller.rb:23:5:23:76 | call to render |
+| app/controllers/foo/bars_controller.rb:35:5:35:33 | call to render |
+| app/controllers/foo/bars_controller.rb:38:5:38:50 | call to render |
+| app/controllers/foo/bars_controller.rb:44:5:44:17 | call to render |
+| app/views/foo/bars/show.html.erb:31:5:31:89 | call to render |
+renderToCalls
+| app/controllers/foo/bars_controller.rb:15:16:15:97 | call to render_to_string |
+| app/controllers/foo/bars_controller.rb:36:12:36:67 | call to render_to_string |
+linkToCalls
+| app/views/foo/bars/show.html.erb:33:5:33:41 | call to link_to |
+httpResponses
+| app/controllers/comments_controller.rb:11:5:11:17 | call to body= | app/controllers/comments_controller.rb:11:21:11:34 | ... = ... | text/http |
+| app/controllers/comments_controller.rb:21:5:21:37 | call to send_file | app/controllers/comments_controller.rb:21:24:21:36 | "my-file.ext" | application/octet-stream |
+| app/controllers/foo/bars_controller.rb:15:16:15:97 | call to render_to_string | app/controllers/foo/bars_controller.rb:15:33:15:47 | "foo/bars/show" | text/html |
+| app/controllers/foo/bars_controller.rb:23:5:23:76 | call to render | app/controllers/foo/bars_controller.rb:23:12:23:26 | "foo/bars/show" | text/html |
+| app/controllers/foo/bars_controller.rb:35:5:35:33 | call to render | app/controllers/foo/bars_controller.rb:35:18:35:33 | call to [] | application/json |
+| app/controllers/foo/bars_controller.rb:36:12:36:67 | call to render_to_string | app/controllers/foo/bars_controller.rb:36:29:36:33 | @user | application/json |
+| app/controllers/foo/bars_controller.rb:38:5:38:50 | call to render | app/controllers/foo/bars_controller.rb:38:12:38:22 | call to backtrace | text/plain |
+| app/controllers/foo/bars_controller.rb:44:5:44:17 | call to render | app/controllers/foo/bars_controller.rb:44:12:44:17 | "show" | text/html |
+rawHelperCalls
+| helpers.erb:4:1:4:36 | call to simple_format | helpers.erb:4:15:4:15 | call to x |
+| helpers.erb:7:1:7:26 | call to truncate | helpers.erb:7:10:7:10 | call to x |
+| helpers.erb:10:1:10:29 | call to highlight | helpers.erb:10:11:10:11 | call to x |
+| helpers.erb:12:1:12:17 | call to javascript_tag | helpers.erb:12:16:12:16 | call to x |
+| helpers.erb:15:1:15:27 | call to content_tag | helpers.erb:15:16:15:16 | call to y |
+| helpers.erb:18:1:18:19 | call to tag | helpers.erb:18:5:18:5 | call to x |
+| helpers.erb:21:1:21:24 | call to h1 | helpers.erb:21:8:21:8 | call to x |
+| helpers.erb:24:1:24:23 | call to p | helpers.erb:24:7:24:7 | call to x |

ruby/ql/test/library-tests/frameworks/ActionView.ql

@@ -1,6 +1,26 @@
-import codeql.ruby.Concepts
-import codeql.ruby.DataFlow
+private import ruby
+private import codeql.ruby.AST
+private import codeql.ruby.frameworks.ActionView
+private import codeql.ruby.frameworks.Rails
+private import codeql.ruby.Concepts
+private import codeql.ruby.DataFlow
 
 query predicate fileSystemResolverAccesses(FileSystemAccess a, DataFlow::Node path) {
   a.getAPathArgument() = path
 }
+
+query predicate rawCalls(RawCall c) { any() }
+
+query predicate renderCalls(Rails::RenderCall c) { any() }
+
+query predicate renderToCalls(Rails::RenderToCall c) { any() }
+
+query predicate linkToCalls(LinkToCall c) { any() }
+
+query predicate httpResponses(Http::Server::HttpResponse r, DataFlow::Node body, string mimeType) {
+  r.getBody() = body and r.getMimetype() = mimeType
+}
+
+query predicate rawHelperCalls(ActionView::Helpers::RawHelperCall c, Expr arg) {
+  arg = c.getRawArgument()
+}

ruby/ql/test/library-tests/frameworks/action_view/ActionView.expected

@@ -0,0 +1,2 @@
+class DummyComponent < ViewComponent::Base
+end

ruby/ql/test/library-tests/frameworks/action_view/ActionView.ql

@@ -0,0 +1,52 @@
+Rails.application.routes.draw do
+  resources :posts, only: [:show, :index] do
+    resources :comments do
+      resources :replies, only: [:create]
+      post "flag", to: :flag
+    end
+    post "upvote", to: "posts#upvote"
+  end
+
+  if Rails.env.test?
+    post "destroy_all_posts", to: "posts#destroy_alll"
+  end
+
+  constraints(number: /[0-9]+/) do
+    get "/numbers/:number", to: "numbers#show"
+  end
+
+  scope path: "/admin" do
+    get "/jobs", to: "background_jobs#index"
+  end
+
+  scope "/admin" do
+    get "secrets", controller: "secrets", action: "view_secrets"
+    delete ":user_id", to: "users#destroy"
+  end
+
+  match "photos/:id" => "photos#show", via: :get
+  match "photos/:id", to: "photos#show", via: :get
+  match "photos/:id", controller: "photos", action: "show", via: :get
+  match "photos/:id", to: "photos#show", via: :all
+
+  scope controller: "users" do
+    post "upgrade", action: "start_upgrade"
+  end
+
+  scope module: "enterprise", controller: "billing" do
+    get "current_billing_cycle"
+  end
+
+  resource :global_config, only: [:show]
+
+  namespace :foo do
+    resources :bar, only: [:index, :show] do
+      get "show_debug", to: :show_debug
+    end
+  end
+
+  scope "/users/:user" do
+    delete "/notifications", to: "users/notifications#destroy", as: :user_destroy_notifications
+    post "notifications/:notification_id/mark_as_read", to: "users/notifications#mark_as_read"
+  end
+end

ruby/ql/test/library-tests/frameworks/action_view/app/components/DummyComponent.rb

@@ -0,0 +1,40 @@
+class CommentsController < ApplicationController
+  def index
+    request.params
+    request.parameters
+    request.GET
+    request.POST
+    request.query_parameters
+    request.request_parameters
+    request.filtered_parameters
+
+    response.body = "some content"
+
+    response.status = 200
+
+    response.header["Content-Type"] = "text/html"
+    response.set_header("Content-Length", 100)
+    response.headers["X-Custom-Header"] = "hi"
+    response["X-Another-Custom-Header"] = "yes"
+    response.add_header "X-Yet-Another", "indeed"
+
+    response.send_file("my-file.ext")
+
+    response.request
+
+    response.location = "http://..." # relevant for url redirect query
+    response.cache_control = "value"
+    response._cache_control = "value"
+    response.etag = "value"
+    response.charset = "value" # sets the charset part of the content-type header
+    response.content_type = "value" # sets the main part of the content-type header
+
+    response.date = Date.today
+    response.last_modified = Date.yesterday
+    response.weak_etag = "value"
+    response.strong_etag = "value"
+  end
+
+  def show
+  end
+end

ruby/ql/test/library-tests/frameworks/action_view/app/config/routes.rb

@@ -0,0 +1,46 @@
+require 'json'
+
+class BarsController < ApplicationController
+
+  def index
+    render template: "foo/bars/index"
+  end
+
+  def show_debug
+    user_info = JSON.load cookies[:user_info]
+    puts "User: #{user_info['name']}"
+
+    @user_website = params[:website]
+    dt = params[:text]
+    rendered = render_to_string "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }
+    puts rendered
+    redirect_to action: "show"
+  end
+
+  def show
+    @user_website = params[:website]
+    dt = params[:text]
+    render "foo/bars/show", locals: { display_text: dt, safe_text: "hello" }
+  end
+  
+  def go_back
+    redirect_back_or_to action: "index"
+  end
+
+  def go_back_2
+    redirect_back fallback_location: { action: "index" }
+  end
+
+  def show_2
+    render json: { some: "data" }
+    body = render_to_string @user, content_type: "application/json"
+  rescue => e
+    render e.backtrace, content_type: "text/plain"
+  end
+
+  private
+
+  def unreachable_action
+    render "show"
+  end
+end

ruby/ql/test/library-tests/frameworks/action_view/app/controllers/comments_controller.rb

@@ -0,0 +1,4 @@
+class PhotosController < ApplicationController
+  def show
+  end
+end

ruby/ql/test/library-tests/frameworks/action_view/app/controllers/foo/bars_controller.rb

@@ -0,0 +1,10 @@
+class PostsController < ApplicationController
+  def index
+  end
+
+  def show
+  end
+  
+  def upvote
+  end
+end