Rails SQL Injection safe SELECT fields

Question

I have the following ruby On Rails code:

#The user can only ask for a subset of the following columns:
authorized_fields= ["id","created_at","updated_at"]

#The user sends the requested columns as a comma separated string in the fields param
fields = (params[:fields].split(',') & authorized_fields).join(",");

#Build the query to be run:
sql = "SELECT json_agg(u) FROM (SELECT #{fields} FROM table_name) u"

#Run the query against the database
ModelName.connection.select_value(sql)

My question is, is this query SQL Injection safe? My understanding is that since I limit the available fields, so it protects me from injections.

Am I correct? Can someone give me an example of a fields parameter sent by the user which will not be safe?

Ilya Lavrov · Accepted Answer · 2017-03-28 14:53:52Z

1

You may use ActiveRecord::Base.connection.quote_column_name. Code should be like this:

input_fields = params[:fields].split(',').collect do |field| 
  ActiveRecord::Base.connection.quote_column_name(field) 
end

answered Mar 28, 2017 at 14:53

Ilya Lavrov

2,8583 gold badges22 silver badges40 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Rails SQL Injection safe SELECT fields

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related