Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-002

SQL injection via find_by_sql interpolation

criticalRubyCWE-89CVSS 9.8

What it detects

Interpolating variables into find_by_sql builds a query vulnerable to SQL injection.

How to fix

Pass an array with bind parameters to find_by_sql instead of interpolating.

Vulnerable — Shield flags thisreports_controller.rb
class ReportsController < ApplicationController
  def index
    @reports = Report.find_by_sql("SELECT * FROM reports WHERE owner_id = #{params[:owner_id]}")
    render json: @reports
  end
end
Fixed — scans cleanreports_controller.rb
class ReportsController < ApplicationController
  def index
    @reports = Report.find_by_sql(["SELECT * FROM reports WHERE owner_id = ?", params[:owner_id]])
    render json: @reports
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-002, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-002: SQL injection via find_by_sql interpolation — Zennoxa Shield