Skip to content

Commit 7facc63

Browse files
authored
remove predicate
1 parent 539fbbc commit 7facc63

1 file changed

Lines changed: 7 additions & 12 deletions

File tree

ruby/ql/src/experimental/weak-params/WeakParams.ql

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -38,21 +38,16 @@ class ActionControllerRequest extends DataFlow::Node {
3838
class WeakParams extends DataFlow::CallNode {
3939
WeakParams() {
4040
this.getReceiver() instanceof ActionControllerRequest and
41-
allParamsAccess(this.asExpr().getExpr())
41+
(
42+
this.getMethodName() = "path_parametes" or
43+
this.getMethodName() = "query_parameters" or
44+
this.getMethodName() = "request_parameters" or
45+
this.getMethodName() = "GET" or
46+
this.getMethodName() = "POST"
47+
)
4248
}
4349
}
4450

45-
/**
46-
* Holds call to a method that exposes or accesses all parameters from an inbound HTTP request
47-
*/
48-
predicate allParamsAccess(MethodCall call) {
49-
call.getMethodName() = "path_parametes" or
50-
call.getMethodName() = "query_parameters" or
51-
call.getMethodName() = "request_parameters" or
52-
call.getMethodName() = "GET" or
53-
call.getMethodName() = "POST"
54-
}
55-
5651
/**
5752
* A Taint tracking config where the source is a weak params access in a controller and the sink
5853
* is a method call of a model class

0 commit comments

Comments
 (0)