def run_check
narrow_targets = [:exists?, :select]
@sql_targets = [:average, :calculate, :count, :count_by_sql, :delete_all, :destroy_all,
:find_by_sql, :maximum, :minimum, :pluck, :sum, :update_all]
@sql_targets.concat [:from, :group, :having, :joins, :lock, :order, :reorder, :where] if tracker.options[:rails3]
@sql_targets << :find_by << :find_by! << :not if tracker.options[:rails4]
if version_between?("2.0.0", "3.9.9") or tracker.config.rails_version.nil?
@sql_targets << :first << :last << :all
end
if version_between?("2.0.0", "4.0.99") or tracker.config.rails_version.nil?
@sql_targets << :find
end
@connection_calls = [:delete, :execute, :insert, :select_all, :select_one,
:select_rows, :select_value, :select_values]
if tracker.options[:rails3]
@connection_calls.concat [:exec_delete, :exec_insert, :exec_query, :exec_update]
else
@connection_calls.concat [:add_limit!, :add_offset_limit!, :add_lock!]
end
@expected_targets = active_record_models.keys + [:connection, "ActiveRecord::Base""ActiveRecord::Base", :Arel]
Brakeman.debug "Finding possible SQL calls on models"
calls = tracker.find_call(:methods => @sql_targets, :nested => true)
calls.concat tracker.find_call(:targets => active_record_models.keys, :methods => narrow_targets, :chained => true)
Brakeman.debug "Finding possible SQL calls with no target"
calls.concat tracker.find_call(:target => nil, :methods => @sql_targets)
Brakeman.debug "Finding possible SQL calls using constantized()"
calls.concat tracker.find_call(:methods => @sql_targets).select { |result| constantize_call? result }
calls.concat tracker.find_call(:targets => @expected_targets, :methods => @connection_calls, :chained => true).select { |result| connect_call? result }
calls.concat tracker.find_call(:target => :Arel, :method => :sql)
Brakeman.debug "Finding calls to named_scope or scope"
calls.concat find_scope_calls
Brakeman.debug "Processing possible SQL calls"
calls.each { |call| process_result call }
end