diff --git a/lib/safe_code/validator.ex b/lib/safe_code/validator.ex index 80aef8a..5bf87bf 100644 --- a/lib/safe_code/validator.ex +++ b/lib/safe_code/validator.ex @@ -63,6 +63,23 @@ defmodule SafeCode.Validator do defp valid_node?({:., _, [{{:., _, [{module, _, _}, func]}, _, _}, _]}, opts), do: safe_module_function?(module, func, opts) defp valid_node?({:., _, [{module, _, _}, func]}, opts), do: safe_module_function?(module, func, opts) defp valid_node?({:., _, [module, func]}, opts) when is_atom(module), do: safe_module_function?(module, func, opts) + defp valid_node?({:not, _, _}, _opts), do: true + defp valid_node?({:||, _, _}, _opts), do: true + defp valid_node?({:&&, _, _}, _opts), do: true + defp valid_node?({:==, _, _}, _opts), do: true + defp valid_node?({:===, _, _}, _opts), do: true + defp valid_node?({:!, _, _}, _opts), do: true + defp valid_node?({:!=, _, _}, _opts), do: true + defp valid_node?({:!==, _, _}, _opts), do: true + defp valid_node?({:<, _, _}, _opts), do: true + defp valid_node?({:>, _, _}, _opts), do: true + defp valid_node?({:>=, _, _}, _opts), do: true + defp valid_node?({:<=, _, _}, _opts), do: true + defp valid_node?({:or, _, _}, _opts), do: true + defp valid_node?({:and, _, _}, _opts), do: true + defp valid_node?({:<>, _, _}, _opts), do: true + defp valid_node?({:++, _, _}, _opts), do: true + defp valid_node?({:--, _, _}, _opts), do: true defp valid_node?({function, _meta, args}, opts) when is_atom(function) and is_list(args) do FunctionValidators.safe_function?(function, opts) diff --git a/lib/safe_code/validator/function_validators/elixir.ex b/lib/safe_code/validator/function_validators/elixir.ex index 191c865..6f4d807 100644 --- a/lib/safe_code/validator/function_validators/elixir.ex +++ b/lib/safe_code/validator/function_validators/elixir.ex @@ -23,7 +23,9 @@ defmodule SafeCode.Validator.FunctionValidators.Elixir do def safe_function?(_), do: false def safe_module_function?(Enum, :map), do: true + def safe_module_function?(Enum, :with_index), do: true def safe_module_function?(Access, :get), do: true + def safe_module_function?(Map, :put), do: true def safe_module_function?(Kernel, fun), do: safe_function?(fun) def safe_module_function?(_, _), do: false diff --git a/lib/safe_code/validator/function_validators/phoenix.ex b/lib/safe_code/validator/function_validators/phoenix.ex index be1c7e6..4d41fc8 100644 --- a/lib/safe_code/validator/function_validators/phoenix.ex +++ b/lib/safe_code/validator/function_validators/phoenix.ex @@ -1,15 +1,37 @@ defmodule SafeCode.Validator.FunctionValidators.Phoenix do @behaviour SafeCode.Validator.FunctionValidators.Behaviour + def safe_function?(:my_component), do: true + def safe_function?(:rem), do: true + def safe_function?(:&), do: true + def safe_function?(:/), do: true + def safe_function?(:{}), do: true def safe_function?(_), do: false + def safe_module_function?(DockYardWeb.EmployeeView, :random_avatar_uri), do: true + def safe_module_function?(DockYardWeb.EmployeeView, :display_name), do: true + def safe_module_function?(DockYardWeb.PostView, :illustration), do: true + def safe_module_function?(DockYardWeb.PostView, :post_path), do: true + def safe_module_function?(DockYardWeb.PostView, :author_avatar_url), do: true + def safe_module_function?(DockYard.ClientLeads, :change_client_lead_form), do: true def safe_module_function?(Phoenix.LiveView.Engine, :live_to_iodata), do: true def safe_module_function?(Phoenix.LiveView.Engine, :changed_assign?), do: true def safe_module_function?(Phoenix.LiveView.Engine, :fetch_assign!), do: true def safe_module_function?(Phoenix.LiveView.Engine, :nested_changed_assign?), do: true + def safe_module_function?(Phoenix.LiveView.Engine, :to_component_static), do: true def safe_module_function?(Phoenix.LiveView.HTMLEngine, :binary_encode), do: true + def safe_module_function?(Phoenix.LiveView.HTMLEngine, :component), do: true + def safe_module_function?(Phoenix.LiveView.HTMLEngine, :function), do: true + def safe_module_function?(Phoenix.LiveView.HTMLEngine, :file), do: true + def safe_module_function?(Phoenix.LiveView.HTMLEngine, :inner_block), do: true def safe_module_function?(Phoenix.HTML, :attributes_escape), do: true def safe_module_function?(:assigns, _), do: true def safe_module_function?(_, _), do: false + + # def safe_module_function?(module, function) do + # IO.inspect("module: #{inspect(module)}") + # IO.inspect("function: #{function}") + # true + # end end diff --git a/test/safe_code/validator_test.exs b/test/safe_code/validator_test.exs index dea53da..be6d648 100644 --- a/test/safe_code/validator_test.exs +++ b/test/safe_code/validator_test.exs @@ -41,6 +41,142 @@ defmodule SafeCode.ValidatorTest do assert Validator.validate_heex!(heex) end + test "accepts the 'not' expression" do + heex = """ + hello <%= not false %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '||' expression" do + heex = """ + hello <%= nil || true %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '&&' expression" do + heex = """ + hello <%= 1 && true %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '!' expression" do + heex = """ + hello <%= !false %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '==' expression" do + heex = """ + hello <%= 1 == 1 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '===' expression" do + heex = """ + hello <%= 1 === 1 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '!==' expression" do + heex = """ + hello <%= 1 !== 2 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '!=' expression" do + heex = """ + hello <%= 1 != 2 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '<' expression" do + heex = """ + hello <%= 1 < 5 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '>' expression" do + heex = """ + hello <%= 1 > 5 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '>=' expression" do + heex = """ + hello <%= 5 >= 1 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '<=' expression" do + heex = """ + hello <%= 1 <= 5 %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the 'or' expression" do + heex = """ + hello <%= false or true %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the 'and' expression" do + heex = """ + hello <%= true and true %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '<>' expression" do + heex = """ + hello <%= "Steve" <> "Rogers" %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '++' expression" do + heex = """ + hello <%= [1,2] ++ [3,4] %> how are you + """ + + assert Validator.validate_heex!(heex) + end + + test "accepts the '--' expression" do + heex = """ + hello <%= [1,2,3] -- [2] %> how are you + """ + + assert Validator.validate_heex!(heex) + end + test "for loop" do heex = """ <%= for foo <- bar do %>