Unsanitized user input in SQL query
- Rule ID: ruby_lang_sql_injection
- Languages: ruby
- Source: sql_injection.yml
Description
Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.
Remediations
-
Do employ bind variables in SQL queries to separate the query structure from the data, effectively preventing SQL injection.
SQLite3::Database.new("data.db") do |db|
db.execute("SELECT * FROM users WHERE username = ?", [unsafe_input])
end -
Do not use raw SQL queries that incorporate unsanitized external input directly. This approach is vulnerable to SQL injection.
SQLite3::Database.new("data.db") do |db|
db.execute("SELECT * FROM users WHERE username = '#{unsafe_input}'")
end
References
Associated CWE
OWASP Top 10
Configuration
To skip this rule during a scan, use the following flag
bearer scan /path/to/your-project/ --skip-rule=ruby_lang_sql_injection
To run only this rule during a scan, use the following flag
bearer scan /path/to/your-project/ --only-rule=ruby_lang_sql_injection