Skip to content

Instantly share code, notes, and snippets.

@yano3nora

yano3nora/rails_security.md

Last active September 16, 2020 01:19
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save yano3nora/cfa2e6a54b852b23cbcea703750ebead to your computer and use it in GitHub Desktop.
Save yano3nora/cfa2e6a54b852b23cbcea703750ebead to your computer and use it in GitHub Desktop.
Download ZIP
[rails: Rails Security] #rails
Raw
rails_security.md

Rails セキュリティガイド

SQL Injection

find や where や HOGE = ? みたいにプレースホルダしている箇所はだいたい安全だと思ってよさそう。逆に group, order, having、exists の引数など文字列を受け取って SQL を組み立てるタイプのやつは to_i するなどしてユーザ入力をそのまま受け付けるようなことは避ける。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment