ruby-on-rails - 事件记录中的动态 where 子句避免 sql 注入(inject)

Question

你知道如何构建一个动态查询来避免sql注入(inject)吗？

property = 'foo'
value = 'bar'
SomeObject.where("#{property} > ?", value)
# works but permit sql inj
SomeObject.where(":property > :value", property: property, value: value)
# create select * from some_object where 'foo' > 'bar'
# and the 'foo' I need without the quotes

Answer 1

SomeObject.where(
  "#{SomeObject.connection.quote_column_name(property)} > :value", 
  value: value
)

更新

示例 1(尝试结束语句并注入(inject)新语句):

property = '; DROP TABLE users; --'
User.where("#{User.connection.quote_column_name(property)} > :value", value: 3)
# => SELECT "users".* FROM "users" WHERE ("; DROP TABLE users; --" > 3)

示例 2(尝试结束列名引号):

property = '"; DELETE FROM users;--'
User.where("#{User.connection.quote_column_name(property)} > :value", value: 3)
# => SELECT "users".* FROM "users" WHERE ("""; DELETE FROM users;--" > 3)