flawopen.com/sql-injection/Ruby

इस पेज के मुख्य शब्द

Web Application Security

सुरक्षा अवधारणा (Web Application Security): Core architecture component affected by CWE-89.

CWE-89

सुरक्षा अवधारणा (CWE-89): Standard Common Weakness Enumeration classification for sql-injection-ruby.

Defense-in-Depth

सुरक्षा अवधारणा (Defense-in-Depth): Multi-layered engineering verification and runtime boundary isolation.

हमले का चरण-दर-चरण प्रवाह

सोर्स कोड: कमज़ोर बनाम सुरक्षित कार्यान्वयन

# params[:id] straight into the string
User.where(
  "id = #{params[:id]}"
)

# value bound, never interpolated
User.where(
  "id = ?", params[:id]
)
# or, more idiomatic still:
User.where(id: params[:id])

इंजीनियरिंग और सिस्टम सुरक्षा चेकलिस्ट

• ✓हमेशा the hash form (where(id: x)) whenever the condition is a simple equality का उपयोग करें।
• ✓हमेशा ? bound parameters for anything more complex — never interpolate into the condition string का उपयोग करें।
• ✓अनुशंसित सुरक्षा नियम: Allow-list column/direction names for anything driving order() or dynamic SQL fragments।
• ✓Brakeman in CI to catch regressions automatically चलाएं।

References

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command
• Rails Guides — Active Record Query Interface, Array Conditions
• Brakeman — SQL Injection warning type
• OWASP SQL इंजेक्शन रोकथाम चीट शीट