mirror of
https://github.com/github/codeql.git
synced 2026-04-17 21:14:02 +02:00
31 lines
1.1 KiB
Ruby
31 lines
1.1 KiB
Ruby
class UsersController < ActionController::Base
|
|
def mysql2_handler(event:, context:)
|
|
name = params[:user_name] # $ Source[rb/sql-injection]
|
|
|
|
conn = Mysql2::Client.new(
|
|
host: "127.0.0.1",
|
|
username: "root"
|
|
)
|
|
# GOOD: SQL statement is not constructed from user input
|
|
results1 = conn.query("SELECT * FROM users")
|
|
|
|
# BAD: SQL statement constructed from user input
|
|
results2 = conn.query("SELECT * FROM users WHERE username='#{name}'") # $ Alert[rb/sql-injection]
|
|
|
|
# GOOD: user input is escaped
|
|
escaped = Mysql2::Client.escape(name)
|
|
results3 = conn.query("SELECT * FROM users WHERE username='#{escaped}'")
|
|
|
|
# GOOD: user input is escaped
|
|
statement1 = conn.prepare("SELECT * FROM users WHERE id >= ? AND username = ?")
|
|
results4 = statement1.execute(1, name, :as => :array)
|
|
|
|
# BAD: SQL statement constructed from user input
|
|
statement2 = conn.prepare("SELECT * FROM users WHERE username='#{name}' AND password = ?") # $ Alert[rb/sql-injection]
|
|
results4 = statement2.execute("password", :as => :array)
|
|
|
|
# NOT EXECUTED
|
|
statement3 = conn.prepare("SELECT * FROM users WHERE username = ?")
|
|
end
|
|
end
|