@@ -12,6 +12,35 @@ private import codeql.ruby.ApiGraphs
12
12
private import codeql.ruby.security.OpenSSL
13
13
private import codeql.ruby.dataflow.FlowSummary
14
14
15
+ private module RenderCallUtils {
16
+ private Expr getTemplatePathArgument ( MethodCall renderCall ) {
17
+ // TODO: support other ways of specifying paths (e.g. `file`)
18
+ result =
19
+ [ renderCall .getKeywordArgument ( [ "partial" , "template" , "action" ] ) , renderCall .getArgument ( 0 ) ]
20
+ }
21
+
22
+ private string getTemplatePathValue ( MethodCall renderCall ) {
23
+ result = getTemplatePathArgument ( renderCall ) .getConstantValue ( ) .getStringlikeValue ( )
24
+ }
25
+
26
+ // everything up to and including the final slash, but ignoring any leading slash
27
+ private string getSubPath ( MethodCall renderCall ) {
28
+ result = getTemplatePathValue ( renderCall ) .regexpCapture ( "^/?(.*/)?(?:[^/]*?)$" , 1 )
29
+ }
30
+
31
+ // everything after the final slash, or the whole string if there is no slash
32
+ private string getBaseName ( MethodCall renderCall ) {
33
+ result = getTemplatePathValue ( renderCall ) .regexpCapture ( "^/?(?:.*/)?([^/]*?)$" , 1 )
34
+ }
35
+
36
+ ErbFile getTemplateFile ( MethodCall renderCall ) {
37
+ result .getTemplateName ( ) = getBaseName ( renderCall ) and
38
+ result .getRelativePath ( ) .matches ( "%app/views/" + getSubPath ( renderCall ) + "%" )
39
+ }
40
+
41
+ HashLiteral getLocals ( MethodCall renderCall ) { result = renderCall .getKeywordArgument ( "locals" ) }
42
+ }
43
+
15
44
/**
16
45
* Provides classes for working with Rails.
17
46
*/
@@ -39,37 +68,15 @@ module Rails {
39
68
* rendered content.
40
69
*/
41
70
class RenderCall extends MethodCall instanceof RenderCallImpl {
42
- private Expr getTemplatePathArgument ( ) {
43
- // TODO: support other ways of specifying paths (e.g. `file`)
44
- result = [ this .getKeywordArgument ( [ "partial" , "template" , "action" ] ) , this .getArgument ( 0 ) ]
45
- }
46
-
47
- private string getTemplatePathValue ( ) {
48
- result = this .getTemplatePathArgument ( ) .getConstantValue ( ) .getStringlikeValue ( )
49
- }
50
-
51
- // everything up to and including the final slash, but ignoring any leading slash
52
- private string getSubPath ( ) {
53
- result = this .getTemplatePathValue ( ) .regexpCapture ( "^/?(.*/)?(?:[^/]*?)$" , 1 )
54
- }
55
-
56
- // everything after the final slash, or the whole string if there is no slash
57
- private string getBaseName ( ) {
58
- result = this .getTemplatePathValue ( ) .regexpCapture ( "^/?(?:.*/)?([^/]*?)$" , 1 )
59
- }
60
-
61
71
/**
62
72
* Gets the template file to be rendered by this call, if any.
63
73
*/
64
- ErbFile getTemplateFile ( ) {
65
- result .getTemplateName ( ) = this .getBaseName ( ) and
66
- result .getRelativePath ( ) .matches ( "%app/views/" + this .getSubPath ( ) + "%" )
67
- }
74
+ ErbFile getTemplateFile ( ) { result = RenderCallUtils:: getTemplateFile ( this ) }
68
75
69
76
/**
70
77
* Get the local variables passed as context to the renderer
71
78
*/
72
- HashLiteral getLocals ( ) { result = this . getKeywordArgument ( "locals" ) }
79
+ HashLiteral getLocals ( ) { result = RenderCallUtils :: getLocals ( this ) }
73
80
// TODO: implicit renders in controller actions
74
81
}
75
82
0 commit comments