False positive - Ruby on Rails: SQL query built from user-controlled sources
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
**Description of the false positive**
Rails execute `sanitize_sql_for_assignment` when `update_all` called with an array as the argument:
https://github.com/rails/rails/blob/v7.0.8/activerecord/lib/active_record/relation.rb#L476
**Code samples or links to source code**
https://github.com/amnis-invictus/ikt.edu.vn.ua/blob/e404674b8efd9c4ed668866787a8a2ef1b91514f/app/channels/api_channel.rb#L82
https://github.com/amnis-invictus/ikt.edu.vn.ua/blob/e404674b8efd9c4ed668866787a8a2ef1b91514f/app/channels/api_channel.rb#L85
**URL to the alert on GitHub code scanning (optional)**
https://github.com/amnis-invictus/ikt.edu.vn.ua/security/code-scanning/307
https://github.com/amnis-invictus/ikt.edu.vn.ua/security/code-scanning/308
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.