Audit
Sqli
ruby-pg-sqli
ruby-pg-sqli
Detected string concatenation with a non-literal variable in a pg Ruby SQL statement. This could lead to SQL injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, use parameterized queries or prepared statements instead. You can use parameterized queries like so: conn.exec_params('SELECT $1 AS a, $2 AS b, $3 AS c', [1, 2, nil]) And you can use prepared statements with exec_prepared.
Likelihood: HIGH
Confidence: MEDIUM
CWE:
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)
OWASP:
- A01:2017 - Injection
- A03:2021 - Injection