mirror of
https://github.com/github/codeql.git
synced 2025-12-20 18:56:32 +01:00
9 lines
306 B
Ruby
9 lines
306 B
Ruby
|
|
class PotatoController < ActionController::Base
|
|
def unsafe_action
|
|
name = params[:user_name]
|
|
# BAD: SQL statement constructed from user input
|
|
sql = Arel.sql("SELECT * FROM users WHERE name = #{name}")
|
|
sql = Arel::Nodes::SqlLiteral.new("SELECT * FROM users WHERE name = #{name}")
|
|
end
|
|
end |