let us say I have a list page of users and you can sort by the different columns, when clicking 'email' it will pass sort_by=email sort_direction=asc or desc
sort_by = "email" # really params[:sort_by]
sort_direction = "asc" # really params[:sort_direction]
User.order("#{sort_by} #{sort_direction}")
# SELECT "users".* FROM "users" ORDER BY email asc
so that works as expected, however if we change the sort_by
sort_by = "email; DELETE from users; --"
User.order("#{sort_by} #{sort_direction}")
# SELECT "users".* FROM "users" ORDER BY email; DELETE from users; -- asc
now we have no more users :(
I can manually build a whitelist of valid sort_by and compare params[:sort_by] to that, but was hoping there is some built in way to handle this kind of thing
Ryan Bates' method:
in your controller:
def index
@users = User.order(sort_by + " " + direction)
end
private
def sort_by
%w{email name}.include?(params[:sort_by]) ? params[:sort_by] : 'name'
end
def direction
%w{asc desc}.include?(params[:direction]) ? params[:direction] : 'asc'
end
Essentially you're making a whitelist, but it's easy to do and insusceptible to injection.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With