def find_dangerous_value exp, ignore_hash
case exp.node_type
when :lit, :str, :const, :colon2, :true, :false, :nil
nil
when :array
unsafe_sql? exp[1]
when :dstr
check_string_interp exp
when :hash
check_hash_values exp unless ignore_hash
when :if
unsafe_sql? exp.then_clause or unsafe_sql? exp.else_clause
when :call
unless IGNORE_METHODS_IN_SQL.include? exp.method
if has_immediate_user_input? exp
exp
elsif exp.method == :to_s
find_dangerous_value exp.target, ignore_hash
else
check_call exp
end
end
when :or
if unsafe = (unsafe_sql?(exp.lhs) || unsafe_sql?(exp.rhs))
unsafe
else
nil
end
when :block, :rlist
unsafe_sql? exp.last
else
if has_immediate_user_input? exp
exp
else
nil
end
end
end