mirror of
https://github.com/github/codeql.git
synced 2026-02-27 12:23:41 +01:00
8 lines
224 B
Ruby
8 lines
224 B
Ruby
|
|
class PotatoController < ActionController::Base
|
|
def unsafe_action
|
|
name = params[:user_name]
|
|
# BAD: SQL statement constructed from user input
|
|
sql = Arel.sql("SELECT * FROM users WHERE name = #{name}")
|
|
end
|
|
end |