Brakeman? #60
Brakeman? #60
Conversation
bcaller
force-pushed
the
brakeman
branch
4 times, most recently
from
424e6cf to
d7bc9e3
Compare
bcaller
force-pushed
the
brakeman
branch
2 times, most recently
from
3e12481 to
dca824f
Compare
bcaller
force-pushed
the
brakeman
branch
4 times, most recently
from
c64bb76 to
7b50ae5
Compare
|
doesn't work |
bcaller
force-pushed
the
brakeman
branch
7 times, most recently
from
0ce75c6 to
eaa1510
Compare
bcaller
force-pushed
the
brakeman
branch
3 times, most recently
from
3b65779 to
77b3119
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
|
||
| class Thing < ActiveRecord::Base | ||
| def inject(params) | ||
| Thing.first.where((((("username = '" + params[:user][:name]) + "' AND password = '") + params[:user][:password]) + "'")) |
There was a problem hiding this comment.
reported by reviewdog 🐶
[semgrep] Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as ActiveRecord which will protect your queries.
Source: https://semgrep.dev/r/ruby.rails.security.injection.tainted-sql-string.tainted-sql-string
Cc @brave/sec-team @thypon @bcaller
|
Q: Can we have brakeman running even if the project is not a having proper |
thypon
removed
invalid
|
|
||
| class Thing < ActiveRecord::Base | ||
| def inject(params) | ||
| Thing.first.where((((("username = '" + params[:user][:name]) + "' AND password = '") + params[:user][:password]) + "'")) |
There was a problem hiding this comment.
reported by reviewdog 🐶
[brakeman] :Possible SQL injection
Source: https://brakemanscanner.org/docs/warning_types/sql_injection/
Cc @brave/sec-team @thypon @bcaller
|
|
||
| class Thing < ActiveRecord::Base | ||
| def inject(params) | ||
| Thing.first.where((((("username = '" + params[:user][:name]) + "' AND password = '") + params[:user][:password]) + "'")) |
There was a problem hiding this comment.
reported by reviewdog 🐶
[brakeman] Possible SQL injection
Source: https://brakemanscanner.org/docs/warning_types/sql_injection/
Cc @brave/sec-team @thypon @bcaller
No need for gemfile
Closes #55