Skip to content

Commit 3dd61ca

Browse files
authored
formatting query
1 parent ee79834 commit 3dd61ca

1 file changed

Lines changed: 9 additions & 8 deletions

File tree

ruby/ql/src/experimental/manually-check-http-verb/ManuallyCheckHttpVerb.ql

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -74,14 +74,14 @@ class RequestGet extends DataFlow::CallNode {
7474

7575
class HttpVerbConfig extends TaintTracking::Configuration {
7676
HttpVerbConfig() { this = "HttpVerbConfig" }
77-
77+
7878
override predicate isSource(DataFlow::Node source) {
79-
source instanceof RequestMethod or
80-
source instanceof RequestRequestMethod or
81-
source instanceof RequestEnvMethod or
82-
source instanceof RequestRawRequestMethod or
83-
source instanceof RequestRequestMethodSymbol or
84-
source instanceof RequestGet
79+
source instanceof RequestMethod or
80+
source instanceof RequestRequestMethod or
81+
source instanceof RequestEnvMethod or
82+
source instanceof RequestRawRequestMethod or
83+
source instanceof RequestRequestMethodSymbol or
84+
source instanceof RequestGet
8585
}
8686

8787
override predicate isSink(DataFlow::Node sink) {
@@ -92,4 +92,5 @@ class HttpVerbConfig extends TaintTracking::Configuration {
9292

9393
from HttpVerbConfig config, DataFlow::Node source, DataFlow::Node sink
9494
where config.hasFlow(source, sink)
95-
select sink.asExpr().getExpr(), source, sink, "Manually checking HTTP verbs is an indication that multiple requests are routed to the same controller action. This could lead to bypassing necessary authorization methods and other protections, like CSRF protection. Prefer using different controller actions for each HTTP method and relying Rails routing to handle mappting resources and verbs to specific methods."
95+
select sink.asExpr().getExpr(), source, sink,
96+
"Manually checking HTTP verbs is an indication that multiple requests are routed to the same controller action. This could lead to bypassing necessary authorization methods and other protections, like CSRF protection. Prefer using different controller actions for each HTTP method and relying Rails routing to handle mappting resources and verbs to specific methods."

0 commit comments

Comments
 (0)