diff --git a/rules/ruby/rails/sql_injection.yml b/rules/ruby/rails/sql_injection.yml index bb7c6251..123adf2a 100644 --- a/rules/ruby/rails/sql_injection.yml +++ b/rules/ruby/rails/sql_injection.yml @@ -117,13 +117,15 @@ auxiliary: scope: cursor - id: ruby_rails_sql_injection_safe_special_arg patterns: - - pattern: | # where(["attr = ?", params[:oops]]) or where({ attr: params[:oops] }) + - pattern: + | # where(["attr = ?", params[:oops]]) or where({ attr: params[:oops] }) $<_>($$<...>) focus: OBJECT_ARG filters: - variable: OBJECT_ARG detection: ruby_rails_sql_injection_safe_special_object_arg - - pattern: | # User.where(["attr = ?", params[:oops]]) or User.where({ attr: params[:oops] }) + - pattern: + | # User.where(["attr = ?", params[:oops]]) or User.where({ attr: params[:oops] }) $<_>.$<_>($$<...>) focus: OBJECT_ARG filters: