Raw SQL Injection Risk (ARCH6055)

Key ruby.orm.raw-sql-injection-risk · Severity critical · Category orm

Building raw SQL with string interpolation/concatenation instead of bound parameters is both an injection vector and a query-plan-cache buster. Values must always be passed as parameters.

Incorrect

def find_by_name(name)
  User.where("name = '#{name}'")  # interpolation = injection
end

Correct

def find_by_name(name)
  User.where("name = ?", name)  # bound parameter
end

Fix

Pass values as parameters with ? or named binds in raw SQL instead of interpolating them.