Fine-tuning Semgrep for Ruby Security: Pundit and SQL injection | sorted unsorted thoughts
In this blog post, we’ll go over the construction and tuning of a few Semgrep rules I created while looking at a Ruby on Rails application. Semgrep is a powerful code analysis tool, and while there are a fair number of community rules, the default rules don’t cover everything, and you get a lot more mileage when rules are customized to the codebase. The first rule focuses on detecting a common API misuse pattern that can make Ruby applications susceptible to SQL injection. This is a generic rule and can be used without modification on most Rails applications. The second rule ensures the correct use of Pundit authorization in a Rails application on specified models. This is more of a “rule template” than a complete rule, and needs a bit of customization based on the codebase being scanned. Before delving into the Pundit authorization check, let’s begin with the simpler rule tailored to identify potential SQL injection. This rule primarily targets the misuse of the sql_sanitize family of
In this blog post, we’ll go over the construction and tuning of a few Semgrep rules I created while looking at a Ruby on Rails application. Semgrep is a powerful code analysis tool, and while there are a fair number of community rules, the default rules don’t cover everything, and you get a lot more mileage when rules are customized to the codebase. The first rule focuses on detecting a common API misuse pattern that can make Ruby applications susceptible to SQL injection. This is a generic rule and can be used without modification on most Rails applications. The second rule ensures the correc
Explore this link on the map →related reading
- Security incident disclosure — July 2026huggingface.co
- From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code - Project Zerogoogleprojectzero.blogspot.com
- Reimagining Security Engineering using Semgrep and OPA | Rohit Salecharohitsalecha.com
- All learning materials - detailed | Web Security Academyportswigger.net
- Against SQLscattered-thoughts.net
- SQL as APIvalentin.willscher.de
- rams - Expert Design Reviews on Every PRrams.ai
- Row Level Security | Supabase Docssupabase.com
- SQL style guide by Simon Holywellsqlstyle.guide
- Tuning YARA-L Rules in Chronicle SIEM | by Chris Martin (@thatsiemguy) | Mediummedium.com
- Hemingway Editorhemingwayapp.com
- From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code - Project Zerogoogleprojectzero.blogspot.com