Closed gpmcadam closed 6 months ago
Great callout, @gpmcadam! I will add this to the backlog and try to get to making the adjustments to get this fixed if/when I can.
In the meantime, as a general Call to Action for anyone - this is a great first issue! Currently the query.ex file is where the logic happens and currently it just looks at the single function call :query
on line 37 to make the association.
I believe in order to translate it to support another similar function, one could take either of the following options:
query!
query_many
My gut feeling is the first option is probably okay to pursue since there aren't nearly as many functions within the Repo/SQL module that we need to support compared to something like File - but take that with a grain of salt l since I have yet to make a rule tweak like this myself since taking on maintenance of Sobelow 🙂
PRs welcome!
The following will detect a low-confidence SQL Injection vector:
However simply replacing
Repo.query(q)
withRepo.query!(q)
(to force a raise) will prevent sobelow from detecting this attack vector.