vetkit.ruby.sql-injection.order-clause
Request input is used as a raw ORDER BY / pluck expression (SQL injection). Rails 6.1+ rejects most non-column strings, older versions execute them verbatim.
Last updated:
Suite: Security
ruby
Request input is used as a raw ORDER BY / pluck expression (SQL injection). Rails 6.1+ rejects most non-column strings, older versions execute them verbatim.
Category: SECURITY · Engine rule severity: WARNING
How to fix it
Map the sort parameter to an allow-list of columns and directions (e.g. a hash lookup) and pass a hash such as order(name: :asc).
References
Source: packages/engine/rules/sast/ruby.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.