@@ -12,6 +12,7 @@ private import codeql.ruby.ApiGraphs
12
12
private import codeql.ruby.security.OpenSSL
13
13
private import codeql.ruby.dataflow.FlowSummary
14
14
15
+ /** Provides utility predicates for extracting information from calls to `render`. */
15
16
private module RenderCallUtils {
16
17
private Expr getTemplatePathArgument ( MethodCall renderCall ) {
17
18
// TODO: support other ways of specifying paths (e.g. `file`)
@@ -33,11 +34,17 @@ private module RenderCallUtils {
33
34
result = getTemplatePathValue ( renderCall ) .regexpCapture ( "^/?(?:.*/)?([^/]*?)$" , 1 )
34
35
}
35
36
37
+ /**
38
+ * Gets the template file to be rendered by this render call, if any.
39
+ */
36
40
ErbFile getTemplateFile ( MethodCall renderCall ) {
37
41
result .getTemplateName ( ) = getBaseName ( renderCall ) and
38
42
result .getRelativePath ( ) .matches ( "%app/views/" + getSubPath ( renderCall ) + "%" )
39
43
}
40
44
45
+ /**
46
+ * Gets the local variables passed as context to the renderer.
47
+ */
41
48
HashLiteral getLocals ( MethodCall renderCall ) { result = renderCall .getKeywordArgument ( "locals" ) }
42
49
}
43
50
@@ -74,7 +81,7 @@ module Rails {
74
81
ErbFile getTemplateFile ( ) { result = RenderCallUtils:: getTemplateFile ( this ) }
75
82
76
83
/**
77
- * Get the local variables passed as context to the renderer
84
+ * Gets the local variables passed as context to the renderer.
78
85
*/
79
86
HashLiteral getLocals ( ) { result = RenderCallUtils:: getLocals ( this ) }
80
87
// TODO: implicit renders in controller actions
0 commit comments