プãƒã‚¸ã‚§ã‚¯ãƒˆå›ºæœ‰ã®ãƒ«ãƒ¼ãƒ«ã‚’指定ã§ãã‚‹Linterã§ã‚ã‚‹ã¨ã“ã‚ã®QuerlyãŒã‚ã¡ã‚ƒä¾¿åˆ© - Islands in the byte streamhttps://github.com/soutaro/querly Rubyを構文解æžã—ãŸASTã«å¯¾ã—ã¦ç‹¬è‡ªDSLã§ãƒ‘ターンマッãƒï¼†ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’出ã™ãƒ„ール プãƒã‚¸ã‚§ã‚¯ãƒˆå›ºæœ‰ã®äº‹æƒ…ã«é…æ…®ã—ãŸLinterã¨ã—ã¦ä½¿ãˆã‚‹ false positive 上ç‰ã§æ³¨æ„å–šèµ·ã¨ã—ã¦ä½¿ã† ãŸã¨ãˆã°Kibelaã® querly.yaml ã‹ã‚‰ä¸€éƒ¨æŠœç²‹ã™ã‚‹ã¨ã“ã‚“ãªæ„Ÿã˜ã§ã™ã€‚ rules: # ... - id: kibela.order_by_string pattern: - "order(:dstr:)" - "where(:dstr:)" - "find(:dstr:)" - "exists?(:dstr:)" message: "æ–‡å—列ã«ã‚ˆã‚‹SQL構築ã¯æœ¬å½“ã«å¿…è¦ã§ã™ã‹ï¼Ÿ SQL Injection を引ãèµ·ã“ã•ãªã„よã†ã«æ°—ã‚’ã¤ã‘ã¦ãã ã•ã„。" - id: kibela.block_call patter
{{#tags}}- {{label}}
{{/tags}}