@@ -12,6 +12,7 @@ private import codeql.ruby.ApiGraphs
1212private import codeql.ruby.security.OpenSSL
1313private import codeql.ruby.dataflow.FlowSummary
1414
15+ /** Provides utility predicates for extracting information from calls to `render`. */
1516private module RenderCallUtils {
1617 private Expr getTemplatePathArgument ( MethodCall renderCall ) {
1718 // TODO: support other ways of specifying paths (e.g. `file`)
@@ -33,11 +34,17 @@ private module RenderCallUtils {
3334 result = getTemplatePathValue ( renderCall ) .regexpCapture ( "^/?(?:.*/)?([^/]*?)$" , 1 )
3435 }
3536
37+ /**
38+ * Gets the template file to be rendered by this render call, if any.
39+ */
3640 ErbFile getTemplateFile ( MethodCall renderCall ) {
3741 result .getTemplateName ( ) = getBaseName ( renderCall ) and
3842 result .getRelativePath ( ) .matches ( "%app/views/" + getSubPath ( renderCall ) + "%" )
3943 }
4044
45+ /**
46+ * Gets the local variables passed as context to the renderer.
47+ */
4148 HashLiteral getLocals ( MethodCall renderCall ) { result = renderCall .getKeywordArgument ( "locals" ) }
4249}
4350
@@ -74,7 +81,7 @@ module Rails {
7481 ErbFile getTemplateFile ( ) { result = RenderCallUtils:: getTemplateFile ( this ) }
7582
7683 /**
77- * Get the local variables passed as context to the renderer
84+ * Gets the local variables passed as context to the renderer.
7885 */
7986 HashLiteral getLocals ( ) { result = RenderCallUtils:: getLocals ( this ) }
8087 // TODO: implicit renders in controller actions
0 commit comments