Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-003

SQL injection via execute interpolation

criticalRubyCWE-89CVSS 9.8

What it detects

Interpolating input into connection.execute allows arbitrary SQL execution.

How to fix

Use exec_query with bind parameters or sanitize input before executing raw SQL.

Vulnerable — Shield flags thisreports_controller.rb
class ReportsController < ApplicationController
  def show
    rows = ActiveRecord::Base.connection.execute("SELECT * FROM reports WHERE id = #{params[:id]}")
    render json: rows.to_a
  end
end
Fixed — scans cleanreports_controller.rb
class ReportsController < ApplicationController
  def show
    rows = ActiveRecord::Base.connection.exec_query(
      "SELECT * FROM reports WHERE id = $1", "report lookup", [[nil, params[:id]]]
    )
    render json: rows.to_a
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-003, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-003: SQL injection via execute interpolation — Zennoxa Shield