magiclabs/alchemy_cms — Issue #176: Security issue in resource-controller
Author: masche842
Created: 2012-02-06 08:13:13+00:00
State: open

I know: It should only be accessible by authorized users... Nontheless:

items = resource_model.where(searchable_resource_attributes.map { |attribute|
"`#{namespaced_resources_name}`.`#{attribute[:name]}` LIKE '%#{params[:query]}%'"
}.join(" OR "))

This line is vulnerable regarding to (i.e.):
http://stackoverflow.com/questions/2962263/rails-sql-injection

Solutions are a bit complicated. Maybe it's better to build every condition on its own and chain them together afterwards. I'll try to figure out a nice piece of code for that.