Rails: Sql injection concern?

Question

My controller finds a user using:

@user = User.find_by_identifier!(params[:id])

In my Users model, i have

class User < ActiveRecord::Base

      def to_param
        identifier
      end

private 

  def create_identifier
    SecureRandom.urlsafe_base64(9)
  end
end

Question: Is this safe from an SQL injection point? And how so, since I have no clue about SQL injection despite reading various articles.

Jared Beck · Accepted Answer · 2013-03-18 05:55:23Z

2

A quick experiment in my own console indicates that find_by_identifier! is safe against SQL injection.

irb(main):005:0> User.find_by_email! "i am sneaky '; drop table woot;"
  User Load (0.8ms)  SELECT "users".* FROM "users" WHERE "users"."email" = 'derp ''; drop table woot;' LIMIT 1

Notice how the generated SQL query escapes the malicious single-quote.

I believe that the to_param and create_identifier in your model are irrelevant.

answered Mar 18, 2013 at 5:55

Jared Beck

17.7k11 gold badges76 silver badges106 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

pratski Over a year ago

That makes sense. I also have another sql query which uses a where conditional in the Users model. I use it in the index action to fetch users from the same city as the current_user: scope :same_city, lambda { |user| joins(:profile).where(:profiles => {:city => user.profile.city})} Would this be a threat? Sorry, I am a complete noob (despite all the points and badges I have racked up on this site)

Jared Beck Over a year ago

This is explained in the Active Record Query Interface Guide

Collectives™ on Stack Overflow

Rails: Sql injection concern?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related