@@ -16,7 +16,7 @@ import codeql.ruby.TaintTracking
1616import DataFlow:: PathGraph
1717
1818/**
19- * any direct parameters reference that happens outside of a strong params method but inside
19+ * A direct parameters reference that happens outside of a strong params method but inside
2020 * of a controller class
2121 */
2222class WeakParams extends Expr {
@@ -45,7 +45,7 @@ class StrongParamsMethod extends Method {
4545}
4646
4747/**
48- * a call to a method that exposes or accesses all parameters from an inbound HTTP request
48+ * A call to a method that exposes or accesses all parameters from an inbound HTTP request
4949 */
5050predicate allParamsAccess ( MethodCall call ) {
5151 call .getMethodName ( ) = "expose_all" or
@@ -65,7 +65,7 @@ class ParamsReference extends ElementReference {
6565}
6666
6767/**
68- * returns either Model or ViewModel classes with a base class of `ViewModel`, `ApplicationRecord` or includes `ActionModel::Model`,
68+ * A Model or ViewModel classes with a base class of `ViewModel`, `ApplicationRecord` or includes `ActionModel::Model`,
6969 * which are required to support the strong parameters pattern
7070 */
7171class ModelClass extends ModuleBase {
@@ -81,16 +81,15 @@ class ModelClass extends ModuleBase {
8181 * where the receiver is an instance of ModelClass
8282 */
8383class ModelClassMethodArgument extends DataFlow:: Node {
84- private DataFlow:: CallNode call ;
8584
8685 ModelClassMethodArgument ( ) {
87- this = call .getArgument ( _) and
88- call .getExprNode ( ) .getNode ( ) .getParent + ( ) instanceof ModelClass
86+ exists ( DataFlow :: CallNode call | this = call .getArgument ( _) |
87+ call .getExprNode ( ) .getNode ( ) .getParent + ( ) instanceof ModelClass )
8988 }
9089}
9190
9291/**
93- * Taint tracking config where the source is a weak params access in a controller and the sink
92+ * A Taint tracking config where the source is a weak params access in a controller and the sink
9493 * is a method call of a model class
9594 */
9695class Configuration extends TaintTracking:: Configuration {
0 commit comments