airbnb/ruby

RiskyActiverecordInvocation false positive

sk- opened this issue · 3 comments

sk- commented

File.exists? should not be flagged by RiskyActiverecordInvocation.

ljharb commented

It's probably impossible to statically differentiate in x.exists? between x being a file or an activerecord object.

sk- commented

@ljharb Agree, but at least you could whitelist File.exists? where File is the ruby class and not a variable. That was the reported issue about, sorry if it wasn't clear.

Also, even in the case file.exists? you could apply some heuristics to decide whether the first parameter corresponds to SQL or not.

  • 👍1
BMorearty commented

Luckily for us, File.exists? is deprecated in favor of File.exist? so I don't think it's necessary to do any work to accommodate it.

The docs say "Deprecated method. Don't use."

  • 👍1