Skip to content

Commit dc853d9

Browse files
hmachmac
committed
Ruby: Model ActiveRecord associations
1 parent fdcb1fa commit dc853d9

File tree

3 files changed

+347
-0
lines changed

3 files changed

+347
-0
lines changed

‎ruby/ql/lib/codeql/ruby/frameworks/ActiveRecord.qll

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -516,3 +516,175 @@ private module Persistence {
516516
override DataFlow::Node getValue() { assignNode.getRhs() = result.asExpr() }
517517
}
518518
}
519+
520+
/**
521+
* A method call inside an ActiveRecord model class that establishes an
522+
* association between this model and another model.
523+
*
524+
* ```rb
525+
* class User
526+
* has_many :posts
527+
* has_one :profile
528+
* end
529+
* ```
530+
*/
531+
private class ActiveRecordAssociation extends DataFlow::CallNode {
532+
private ActiveRecordModelClass modelClass;
533+
534+
ActiveRecordAssociation() {
535+
not exists(this.asExpr().getExpr().getEnclosingMethod()) and
536+
this.asExpr().getExpr().getEnclosingModule() = modelClass and
537+
this.getMethodName() = ["has_one", "has_many", "belongs_to", "has_and_belongs_to_many"]
538+
}
539+
540+
/**
541+
* Gets the class which declares this association.
542+
* For example, in
543+
* ```rb
544+
* class User
545+
* has_many :posts
546+
* end
547+
* ```
548+
* the source class is `User`.
549+
*/
550+
ActiveRecordModelClass getSourceClass() { result = modelClass }
551+
552+
/**
553+
* Gets the class which this association refers to.
554+
* For example, in
555+
* ```rb
556+
* class User
557+
* has_many :posts
558+
* end
559+
* ```
560+
* the target class is `Post`.
561+
*/
562+
ActiveRecordModelClass getTargetClass() {
563+
result.getName().toLowerCase() = this.getTargetModelName()
564+
}
565+
566+
/**
567+
* Gets the (lowercase) name of the model this association targets.
568+
* For example, in `has_many :posts`, this is `post`.
569+
*/
570+
string getTargetModelName() {
571+
exists(string s |
572+
s = this.getArgument(0).asExpr().getExpr().getConstantValue().getStringlikeValue()
573+
|
574+
// has_one :profile
575+
// belongs_to :user
576+
this.isSingular() and
577+
result = s
578+
or
579+
// has_many :posts
580+
// has_many :stories
581+
this.isCollection() and
582+
pluralize(result) = s
583+
)
584+
}
585+
586+
/** Holds if this association is one-to-one */
587+
predicate isSingular() { this.getMethodName() = ["has_one", "belongs_to"] }
588+
589+
/** Holds if this association is one-to-many or many-to-many */
590+
predicate isCollection() { this.getMethodName() = ["has_many", "has_and_belongs_to_many"] }
591+
}
592+
593+
/**
594+
* Converts `input` to plural form.
595+
*/
596+
bindingset[input]
597+
bindingset[result]
598+
private string pluralize(string input) {
599+
exists(string stem | stem + "y" = input | result = stem + "ies")
600+
or
601+
result = input + "s"
602+
}
603+
604+
/**
605+
* A call to a method generated by an ActiveRecord association.
606+
* These yield ActiveRecord collection proxies, which act like collections but
607+
* add some additional methods.
608+
* We exclude `<model>_changed?` and `<model>_previously_changed?` because these
609+
* do not yield ActiveRecord instances.
610+
* https://api.rubyonrails.org/classes/ActiveRecord/Associations/ClassMethods.html
611+
*/
612+
private class ActiveRecordAssociationMethodCall extends DataFlow::CallNode {
613+
ActiveRecordAssociation assoc;
614+
615+
ActiveRecordAssociationMethodCall() {
616+
exists(string model | model = assoc.getTargetModelName() |
617+
this.getReceiver().(ActiveRecordInstance).getClass() = assoc.getSourceClass() and
618+
(
619+
assoc.isCollection() and
620+
(
621+
this.getMethodName() = pluralize(model) + ["", "=", "<<"]
622+
or
623+
this.getMethodName() = model + ["_ids", "_ids="]
624+
)
625+
or
626+
assoc.isSingular() and
627+
(
628+
this.getMethodName() = model + ["", "="] or
629+
this.getMethodName() = ["build_", "reload_"] + model or
630+
this.getMethodName() = "create_" + model + ["!", ""]
631+
)
632+
)
633+
)
634+
}
635+
636+
ActiveRecordAssociation getAssociation() { result = assoc }
637+
}
638+
639+
/**
640+
* A method call on an ActiveRecord collection proxy that yields one or more
641+
* ActiveRecord instances.
642+
* Example:
643+
* ```rb
644+
* class User < ActiveRecord::Base
645+
* has_many :posts
646+
* end
647+
*
648+
* User.new.posts.create
649+
* ```
650+
* https://api.rubyonrails.org/classes/ActiveRecord/Associations/ClassMethods.html
651+
*/
652+
private class ActiveRecordCollectionProxyMethodCall extends DataFlow::CallNode {
653+
ActiveRecordCollectionProxyMethodCall() {
654+
this.getMethodName() =
655+
[
656+
"push", "concat", "build", "create", "create!", "delete", "delete_all", "destroy",
657+
"destroy_all", "find", "distinct", "reset", "reload"
658+
] and
659+
(
660+
this.getReceiver().(ActiveRecordAssociationMethodCall).getAssociation().isCollection()
661+
or
662+
exists(ActiveRecordCollectionProxyMethodCall receiver | receiver = this.getReceiver() |
663+
receiver.getAssociation().isCollection() and
664+
receiver.getMethodName() = ["reset", "reload", "distinct"]
665+
)
666+
)
667+
}
668+
669+
ActiveRecordAssociation getAssociation() {
670+
result = this.getReceiver().(ActiveRecordAssociationMethodCall).getAssociation()
671+
}
672+
}
673+
674+
/**
675+
* A call to an association method which yields ActiveRecord instances.
676+
*/
677+
private class ActiveRecordAssociationModelInstantiation extends ActiveRecordModelInstantiation instanceof ActiveRecordAssociationMethodCall {
678+
override ActiveRecordModelClass getClass() {
679+
result = this.(ActiveRecordAssociationMethodCall).getAssociation().getTargetClass()
680+
}
681+
}
682+
683+
/**
684+
* A call to a method on a collection proxy which yields ActiveRecord instances.
685+
*/
686+
private class ActiveRecordCollectionProxyModelInstantiation extends ActiveRecordModelInstantiation instanceof ActiveRecordCollectionProxyMethodCall {
687+
override ActiveRecordModelClass getClass() {
688+
result = this.(ActiveRecordCollectionProxyMethodCall).getAssociation().getTargetClass()
689+
}
690+
}

‎ruby/ql/test/library-tests/frameworks/active_record/ActiveRecord.expected

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,94 @@ activeRecordModelClasses
22
| ActiveRecord.rb:1:1:3:3 | UserGroup |
33
| ActiveRecord.rb:5:1:15:3 | User |
44
| ActiveRecord.rb:17:1:21:3 | Admin |
5+
| associations.rb:1:1:3:3 | Author |
6+
| associations.rb:5:1:9:3 | Post |
7+
| associations.rb:11:1:13:3 | Tag |
8+
| associations.rb:15:1:17:3 | Comment |
59
activeRecordInstances
610
| ActiveRecord.rb:9:5:9:68 | call to find |
711
| ActiveRecord.rb:13:5:13:40 | call to find_by |
12+
| ActiveRecord.rb:13:5:13:46 | call to users |
813
| ActiveRecord.rb:36:5:36:30 | call to find_by_name |
914
| ActiveRecord.rb:55:5:57:7 | if ... |
1015
| ActiveRecord.rb:55:43:56:40 | then ... |
1116
| ActiveRecord.rb:56:7:56:40 | call to find_by |
1217
| ActiveRecord.rb:60:5:60:33 | call to find_by |
1318
| ActiveRecord.rb:62:5:62:34 | call to find |
19+
| associations.rb:19:1:19:20 | ... = ... |
20+
| associations.rb:19:1:19:20 | ... = ... |
21+
| associations.rb:19:11:19:20 | call to new |
22+
| associations.rb:21:1:21:28 | ... = ... |
23+
| associations.rb:21:1:21:28 | ... = ... |
24+
| associations.rb:21:9:21:15 | author1 |
25+
| associations.rb:21:9:21:21 | call to posts |
26+
| associations.rb:21:9:21:28 | call to create |
27+
| associations.rb:23:1:23:32 | ... = ... |
28+
| associations.rb:23:12:23:16 | post1 |
29+
| associations.rb:23:12:23:25 | call to comments |
30+
| associations.rb:23:12:23:32 | call to create |
31+
| associations.rb:25:1:25:22 | ... = ... |
32+
| associations.rb:25:1:25:22 | ... = ... |
33+
| associations.rb:25:11:25:15 | post1 |
34+
| associations.rb:25:11:25:22 | call to author |
35+
| associations.rb:27:1:27:28 | ... = ... |
36+
| associations.rb:27:1:27:28 | ... = ... |
37+
| associations.rb:27:9:27:15 | author2 |
38+
| associations.rb:27:9:27:21 | call to posts |
39+
| associations.rb:27:9:27:28 | call to create |
40+
| associations.rb:29:1:29:7 | author2 |
41+
| associations.rb:29:1:29:13 | call to posts |
42+
| associations.rb:29:18:29:22 | post2 |
43+
| associations.rb:33:1:33:5 | post2 |
44+
| associations.rb:33:1:33:14 | call to comments |
45+
| associations.rb:33:1:33:21 | call to create |
46+
| associations.rb:35:1:35:7 | author1 |
47+
| associations.rb:35:1:35:13 | call to posts |
48+
| associations.rb:35:1:35:20 | call to reload |
49+
| associations.rb:35:1:35:27 | call to create |
50+
| associations.rb:37:1:37:5 | post1 |
51+
| associations.rb:38:1:38:5 | post1 |
52+
| associations.rb:40:1:40:7 | author1 |
53+
| associations.rb:40:1:40:13 | call to posts |
54+
| associations.rb:40:1:40:25 | call to push |
55+
| associations.rb:40:20:40:24 | post2 |
56+
| associations.rb:41:1:41:7 | author1 |
57+
| associations.rb:41:1:41:13 | call to posts |
58+
| associations.rb:41:1:41:27 | call to concat |
59+
| associations.rb:41:22:41:26 | post2 |
60+
| associations.rb:42:1:42:7 | author1 |
61+
| associations.rb:42:1:42:13 | call to posts |
62+
| associations.rb:42:1:42:19 | call to build |
63+
| associations.rb:43:1:43:7 | author1 |
64+
| associations.rb:43:1:43:13 | call to posts |
65+
| associations.rb:43:1:43:20 | call to create |
66+
| associations.rb:44:1:44:7 | author1 |
67+
| associations.rb:44:1:44:13 | call to posts |
68+
| associations.rb:44:1:44:21 | call to create! |
69+
| associations.rb:45:1:45:7 | author1 |
70+
| associations.rb:45:1:45:13 | call to posts |
71+
| associations.rb:45:1:45:20 | call to delete |
72+
| associations.rb:46:1:46:7 | author1 |
73+
| associations.rb:46:1:46:13 | call to posts |
74+
| associations.rb:46:1:46:24 | call to delete_all |
75+
| associations.rb:47:1:47:7 | author1 |
76+
| associations.rb:47:1:47:13 | call to posts |
77+
| associations.rb:47:1:47:21 | call to destroy |
78+
| associations.rb:48:1:48:7 | author1 |
79+
| associations.rb:48:1:48:13 | call to posts |
80+
| associations.rb:48:1:48:25 | call to destroy_all |
81+
| associations.rb:49:1:49:7 | author1 |
82+
| associations.rb:49:1:49:13 | call to posts |
83+
| associations.rb:49:1:49:22 | call to distinct |
84+
| associations.rb:49:1:49:36 | call to find |
85+
| associations.rb:50:1:50:7 | author1 |
86+
| associations.rb:50:1:50:13 | call to posts |
87+
| associations.rb:50:1:50:19 | call to reset |
88+
| associations.rb:50:1:50:33 | call to find |
89+
| associations.rb:51:1:51:7 | author1 |
90+
| associations.rb:51:1:51:13 | call to posts |
91+
| associations.rb:51:1:51:20 | call to reload |
92+
| associations.rb:51:1:51:34 | call to find |
1493
activeRecordSqlExecutionRanges
1594
| ActiveRecord.rb:9:33:9:67 | "name='#{...}' and pass='#{...}'" |
1695
| ActiveRecord.rb:19:16:19:24 | condition |
@@ -53,6 +132,13 @@ activeRecordModelClassMethodCalls
53132
| ActiveRecord.rb:92:5:92:71 | call to update |
54133
| ActiveRecord.rb:98:13:98:54 | call to annotate |
55134
| ActiveRecord.rb:102:13:102:77 | call to annotate |
135+
| associations.rb:2:3:2:17 | call to has_many |
136+
| associations.rb:6:3:6:20 | call to belongs_to |
137+
| associations.rb:7:3:7:20 | call to has_many |
138+
| associations.rb:8:3:8:31 | call to has_and_belongs_to_many |
139+
| associations.rb:12:3:12:32 | call to has_and_belongs_to_many |
140+
| associations.rb:16:3:16:18 | call to belongs_to |
141+
| associations.rb:19:11:19:20 | call to new |
56142
potentiallyUnsafeSqlExecutingMethodCall
57143
| ActiveRecord.rb:9:5:9:68 | call to find |
58144
| ActiveRecord.rb:19:5:19:25 | call to destroy_by |
@@ -68,10 +154,48 @@ potentiallyUnsafeSqlExecutingMethodCall
68154
activeRecordModelInstantiations
69155
| ActiveRecord.rb:9:5:9:68 | call to find | ActiveRecord.rb:5:1:15:3 | User |
70156
| ActiveRecord.rb:13:5:13:40 | call to find_by | ActiveRecord.rb:1:1:3:3 | UserGroup |
157+
| ActiveRecord.rb:13:5:13:46 | call to users | ActiveRecord.rb:5:1:15:3 | User |
71158
| ActiveRecord.rb:36:5:36:30 | call to find_by_name | ActiveRecord.rb:5:1:15:3 | User |
72159
| ActiveRecord.rb:56:7:56:40 | call to find_by | ActiveRecord.rb:5:1:15:3 | User |
73160
| ActiveRecord.rb:60:5:60:33 | call to find_by | ActiveRecord.rb:5:1:15:3 | User |
74161
| ActiveRecord.rb:62:5:62:34 | call to find | ActiveRecord.rb:5:1:15:3 | User |
162+
| associations.rb:19:11:19:20 | call to new | associations.rb:1:1:3:3 | Author |
163+
| associations.rb:21:9:21:21 | call to posts | associations.rb:5:1:9:3 | Post |
164+
| associations.rb:21:9:21:28 | call to create | associations.rb:5:1:9:3 | Post |
165+
| associations.rb:23:12:23:25 | call to comments | associations.rb:15:1:17:3 | Comment |
166+
| associations.rb:23:12:23:32 | call to create | associations.rb:15:1:17:3 | Comment |
167+
| associations.rb:25:11:25:22 | call to author | associations.rb:1:1:3:3 | Author |
168+
| associations.rb:27:9:27:21 | call to posts | associations.rb:5:1:9:3 | Post |
169+
| associations.rb:27:9:27:28 | call to create | associations.rb:5:1:9:3 | Post |
170+
| associations.rb:29:1:29:13 | call to posts | associations.rb:5:1:9:3 | Post |
171+
| associations.rb:33:1:33:14 | call to comments | associations.rb:15:1:17:3 | Comment |
172+
| associations.rb:33:1:33:21 | call to create | associations.rb:15:1:17:3 | Comment |
173+
| associations.rb:35:1:35:13 | call to posts | associations.rb:5:1:9:3 | Post |
174+
| associations.rb:35:1:35:20 | call to reload | associations.rb:5:1:9:3 | Post |
175+
| associations.rb:40:1:40:13 | call to posts | associations.rb:5:1:9:3 | Post |
176+
| associations.rb:40:1:40:25 | call to push | associations.rb:5:1:9:3 | Post |
177+
| associations.rb:41:1:41:13 | call to posts | associations.rb:5:1:9:3 | Post |
178+
| associations.rb:41:1:41:27 | call to concat | associations.rb:5:1:9:3 | Post |
179+
| associations.rb:42:1:42:13 | call to posts | associations.rb:5:1:9:3 | Post |
180+
| associations.rb:42:1:42:19 | call to build | associations.rb:5:1:9:3 | Post |
181+
| associations.rb:43:1:43:13 | call to posts | associations.rb:5:1:9:3 | Post |
182+
| associations.rb:43:1:43:20 | call to create | associations.rb:5:1:9:3 | Post |
183+
| associations.rb:44:1:44:13 | call to posts | associations.rb:5:1:9:3 | Post |
184+
| associations.rb:44:1:44:21 | call to create! | associations.rb:5:1:9:3 | Post |
185+
| associations.rb:45:1:45:13 | call to posts | associations.rb:5:1:9:3 | Post |
186+
| associations.rb:45:1:45:20 | call to delete | associations.rb:5:1:9:3 | Post |
187+
| associations.rb:46:1:46:13 | call to posts | associations.rb:5:1:9:3 | Post |
188+
| associations.rb:46:1:46:24 | call to delete_all | associations.rb:5:1:9:3 | Post |
189+
| associations.rb:47:1:47:13 | call to posts | associations.rb:5:1:9:3 | Post |
190+
| associations.rb:47:1:47:21 | call to destroy | associations.rb:5:1:9:3 | Post |
191+
| associations.rb:48:1:48:13 | call to posts | associations.rb:5:1:9:3 | Post |
192+
| associations.rb:48:1:48:25 | call to destroy_all | associations.rb:5:1:9:3 | Post |
193+
| associations.rb:49:1:49:13 | call to posts | associations.rb:5:1:9:3 | Post |
194+
| associations.rb:49:1:49:22 | call to distinct | associations.rb:5:1:9:3 | Post |
195+
| associations.rb:50:1:50:13 | call to posts | associations.rb:5:1:9:3 | Post |
196+
| associations.rb:50:1:50:19 | call to reset | associations.rb:5:1:9:3 | Post |
197+
| associations.rb:51:1:51:13 | call to posts | associations.rb:5:1:9:3 | Post |
198+
| associations.rb:51:1:51:20 | call to reload | associations.rb:5:1:9:3 | Post |
75199
persistentWriteAccesses
76200
| ActiveRecord.rb:72:5:72:24 | call to create | ActiveRecord.rb:72:18:72:23 | call to params |
77201
| ActiveRecord.rb:76:5:76:66 | call to create | ActiveRecord.rb:76:24:76:36 | ...[...] |

‎ruby/ql/test/library-tests/frameworks/active_record/associations.rb

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
class Author < ActiveRecord::Base
2+
has_many :posts
3+
end
4+
5+
class Post < ActiveRecord::Base
6+
belongs_to :author
7+
has_many :comments
8+
has_and_belongs_to_many :tags
9+
end
10+
11+
class Tag < ActiveRecord::Base
12+
has_and_belongs_to_many :posts
13+
end
14+
15+
class Comment < ActiveRecord::Base
16+
belongs_to :post
17+
end
18+
19+
author1 = Author.new
20+
21+
post1 = author1.posts.create
22+
23+
comment1 = post1.comments.create
24+
25+
author2 = post1.author
26+
27+
post2 = author2.posts.create
28+
29+
author2.posts << post2
30+
31+
# The final method call in this chain should not be recognised as an
32+
# instantiation.
33+
post2.comments.create.create
34+
35+
author1.posts.reload.create
36+
37+
post1.build_tag
38+
post1.build_tag
39+
40+
author1.posts.push(post2)
41+
author1.posts.concat(post2)
42+
author1.posts.build
43+
author1.posts.create
44+
author1.posts.create!
45+
author1.posts.delete
46+
author1.posts.delete_all
47+
author1.posts.destroy
48+
author1.posts.destroy_all
49+
author1.posts.distinct.find(post_id)
50+
author1.posts.reset.find(post_id)
51+
author1.posts.reload.find(post_id)

0 commit comments

Comments
 (0)