Question

I have a method like this in my RoR 3 app

  def buscar
    array = params[:query].split(' ')
    array.each_with_index  do |query, index|
      array[index] = array[index].gsub(/<\/?[^>]*>/, "").downcase
    end
    @noticias = Noticia.where(:tags.all => array).paginate(:page => params[:page])
  end

I’m using brakeman to scan for any problems, and he says this

Possible SQL injection near line 116: Noticia.where(:tags.all => (params[:query].split(" ")))

How can I change the query to evict this problem?
Oh, i’m using mongoid
Thanks in advance

Answer 1

This is untested, but something like this:

tag = params[:query].split(" ")
tag.each do |tag|
  @noticias << Noticias.find_by_tag(tag)
end
@noticias.paginate(:page => params[:page])

You may have to mess with the <<. I’m not sure what paginate looks for in the @noticias object.