New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add PG::Connection.escape_string as authorized sanitization function #1789

Merged

presidentbeef merged 2 commits into presidentbeef:main from joevin-slq-docto:handle_pg_connection_escape_string

Oct 13, 2023

Contributor

joevin-slq-docto commented Aug 10, 2023 •

edited

Hello,

In the same way as ActiveRecord::Base.sanitize_sql(), I suggest adding PG::Connection.escape_string() as an authorized function to sanitize sql statments.

Using this will never be as good as using prepared statements, but this addition, if deemed relevant, would limit false positives.

Thanks!
Nb: escape is an alias for escape_string.

joevin-slq-docto added 2 commits

August 10, 2023 17:15


          add PG::Connection.escape_string as authorized sanitization function

89227aa


          add PG::Connection.escape as authorized sanitization function

6bb1e7f

presidentbeef merged commit 4353b8a into presidentbeef:main

8 checks passed

Owner

presidentbeef commented Oct 13, 2023

Cool, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment