Module: ForestAdminAgent::Utils::QueryValidator

Defined in:
lib/forest_admin_agent/utils/query_validator.rb

Constant Summary collapse

FORBIDDEN_KEYWORDS = 
%w[DROP DELETE INSERT UPDATE ALTER].freeze
INJECTION_PATTERNS = 
[
  /\bOR\s+1=1\b/i # OR 1=1
].freeze

Class Method Summary collapse

Class Method Details

.valid?(query) ⇒ Boolean

Returns:

  • (Boolean)

Raises:



9
10
11
12
13
14
15
16
17
18
19
20
21
 
# File 'lib/forest_admin_agent/utils/query_validator.rb', line 9

def self.valid?(query)
  query = query.strip
  raise Http::Exceptions::BadRequestError, 'Query cannot be empty.' if query.empty?

  sanitized_query = remove_content_inside_strings(query)
  check_select_only(sanitized_query)
  check_semicolon_placement(sanitized_query)
  check_forbidden_keywords(sanitized_query)
  check_unbalanced_parentheses(sanitized_query)
  check_sql_injection_patterns(sanitized_query)

  true
end