Read about our upcoming Code of Conduct on this issue

Commit 9770c57f authored by Brian Neel's avatar Brian Neel
Browse files

Re-enable SqlInjection and CommandInjection

parent 6cf7e631684c
......@@ -37,7 +37,7 @@ def labels_to_transfer
union = Gitlab::SQL::Union.new(label_ids)
Label.where("labels.id IN (#{union.to_sql})").reorder(nil).uniq
Label.where("labels.id IN (#{union.to_sql})").reorder(nil).uniq # rubocop:disable GitlabSecurity/SqlInjection
end
def group_labels_applied_to_issues
......
......@@ -4,7 +4,7 @@ class PagesWorker
sidekiq_options queue: :pages, retry: false
def perform(action, *arg)
send(action, *arg)
send(action, *arg) # rubocop:disable GitlabSecurity/PublicSend
end
def deploy(build_id)
......
......@@ -176,7 +176,7 @@ class Application < Rails::Application
next unless name.include?('namespace_project')
define_method(name.sub('namespace_project', 'project')) do |project, *args|
send(name, project&.namespace, project, *args)
send(name, project&.namespace, project, *args) # rubocop:disable GitlabSecurity/PublicSend
end
end
end
......
......@@ -18,7 +18,7 @@ def _update_record(attribute_names = self.attribute_names) #:nodoc:
lock_col = self.class.locking_column
previous_lock_value = send(lock_col).to_i
previous_lock_value = send(lock_col).to_i # rubocop:disable GitlabSecurity/PublicSend
# This line is added as a patch
previous_lock_value = nil if previous_lock_value == '0' || previous_lock_value == 0
......@@ -48,7 +48,7 @@ def _update_record(attribute_names = self.attribute_names) #:nodoc:
# If something went wrong, revert the version.
rescue Exception
send(lock_col + '=', previous_lock_value)
send(lock_col + '=', previous_lock_value) # rubocop:disable GitlabSecurity/PublicSend
raise
end
end
......
# rubocop:disable GitlabSecurity/PublicSend
module API
module Helpers
module MembersHelpers
def find_source(source_type, id)
public_send("find_#{source_type}!", id)
public_send("find_#{source_type}!", id) # rubocop:disable GitlabSecurity/PublicSend
end
def authorize_admin_source!(source_type, source)
......
......@@ -139,7 +139,7 @@ class Notes < Grape::API
helpers do
def find_project_noteable(noteables_str, noteable_id)
public_send("find_project_#{noteables_str.singularize}", noteable_id)
public_send("find_project_#{noteables_str.singularize}", noteable_id) # rubocop:disable GitlabSecurity/PublicSend
end
def noteable_read_ability_name(noteable)
......
......@@ -254,7 +254,7 @@ def reset_state
def state
state = STATE_PARAMS.inject({}) do |h, param|
h[param] = send(param)
h[param] = send(param) # rubocop:disable GitlabSecurity/PublicSend
h
end
Base64.urlsafe_encode64(state.to_json)
......@@ -266,7 +266,7 @@ def restore_state(new_state, stream)
return if state[:offset].to_i > stream.size
STATE_PARAMS.each do |param|
send("#{param}=".to_sym, state[param])
send("#{param}=".to_sym, state[param]) # rubocop:disable GitlabSecurity/PublicSend
end
end
......
......@@ -47,7 +47,7 @@ def initialize(project)
def collect
query = project.pipelines
.where("? > #{Ci::Pipeline.table_name}.created_at AND #{Ci::Pipeline.table_name}.created_at > ?", @to, @from)
.where("? > #{Ci::Pipeline.table_name}.created_at AND #{Ci::Pipeline.table_name}.created_at > ?", @to, @from) # rubocop:disable GitlabSecurity/SqlInjection
totals_count = grouped_count(query)
success_count = grouped_count(query.success)
......
......@@ -21,7 +21,7 @@ def serialize_keys
def to_hash
hash = {}
serialize_keys.each { |key| hash[key] = send(key) }
serialize_keys.each { |key| hash[key] = send(key) } # rubocop:disable GitlabSecurity/PublicSend
hash
end
......
......@@ -319,7 +319,7 @@ def no_commit_message
def to_hash
serialize_keys.map.with_object({}) do |key, hash|
hash[key] = send(key)
hash[key] = send(key) # rubocop:disable GitlabSecurity/PublicSend
end
end
......@@ -412,7 +412,7 @@ def init_from_hash(hash)
raw_commit = hash.symbolize_keys
serialize_keys.each do |key|
send("#{key}=", raw_commit[key])
send("#{key}=", raw_commit[key]) # rubocop:disable GitlabSecurity/PublicSend
end
end
......
......@@ -143,7 +143,7 @@ def to_hash
hash = {}
SERIALIZE_KEYS.each do |key|
hash[key] = send(key)
hash[key] = send(key) # rubocop:disable GitlabSecurity/PublicSend
end
hash
......@@ -221,7 +221,7 @@ def init_from_hash(hash)
raw_diff = hash.symbolize_keys
SERIALIZE_KEYS.each do |key|
send(:"#{key}=", raw_diff[key.to_sym])
send(:"#{key}=", raw_diff[key.to_sym]) # rubocop:disable GitlabSecurity/PublicSend
end
end
......
......@@ -7,13 +7,13 @@ class Diff
def initialize(params)
params.each do |key, val|
public_send(:"#{key}=", val)
public_send(:"#{key}=", val) # rubocop:disable GitlabSecurity/PublicSend
end
end
def ==(other)
FIELDS.all? do |field|
public_send(field) == other.public_send(field)
public_send(field) == other.public_send(field) # rubocop:disable GitlabSecurity/PublicSend
end
end
end
......
......@@ -45,7 +45,7 @@ def issues
end
def all
REFERABLES.each { |referable| send(referable.to_s.pluralize) }
REFERABLES.each { |referable| send(referable.to_s.pluralize) } # rubocop:disable GitlabSecurity/PublicSend
@references.values.flatten
end
......
......@@ -18,7 +18,7 @@ def base_class
#
# Pass it along if we respond to it.
def [](key)
send(key) if respond_to?(key)
send(key) if respond_to?(key) # rubocop:disable GitlabSecurity/PublicSend
end
def to_param
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment