Skip to content

Commit b305c13

Browse files
committed
Ruby: update SQLite3 model
1 parent 2ef010f commit b305c13

1 file changed

Lines changed: 11 additions & 13 deletions

File tree

ruby/ql/lib/codeql/ruby/frameworks/Sqlite3.qll

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,21 +15,19 @@ private import codeql.ruby.Concepts
1515
* https://github.com/sparklemotion/sqlite3-ruby
1616
*/
1717
module Sqlite3 {
18+
private API::Node databaseConst() {
19+
result = API::getTopLevelMember("SQLite3").getMember("Database")
20+
}
21+
22+
private API::Node dbInstance() {
23+
result = databaseConst().getInstance()
24+
or
25+
result = databaseConst().getMethod("new").getBlock().getParameter(0)
26+
}
27+
1828
/** Gets a method call with a receiver that is a database instance. */
1929
private DataFlow::CallNode getADatabaseMethodCall(string methodName) {
20-
exists(API::Node dbInstance |
21-
dbInstance = API::getTopLevelMember("SQLite3").getMember("Database").getInstance() and
22-
(
23-
result = dbInstance.getAMethodCall(methodName)
24-
or
25-
// e.g. SQLite3::Database.new("foo.db") |db| { db.some_method }
26-
exists(DataFlow::BlockNode block |
27-
result.getMethodName() = methodName and
28-
block = dbInstance.getAValueReachableFromSource().(DataFlow::CallNode).getBlock() and
29-
block.getParameter(0).flowsTo(result.getReceiver())
30-
)
31-
)
32-
)
30+
result = dbInstance().getAMethodCall(methodName)
3331
}
3432

3533
/** A prepared but unexecuted SQL statement. */

0 commit comments

Comments
 (0)