flâneur

Fine-tuning Semgrep for Ruby Security: Pundit and SQL injection | sorted unsorted thoughts

blog.siddarthadukia.com · 2,910 words · saved by 1 readers

In this blog post, we’ll go over the construction and tuning of a few Semgrep rules I created while looking at a Ruby on Rails application. Semgrep is a powerful code analysis tool, and while there are a fair number of community rules, the default rules don’t cover everything, and you get a lot more mileage when rules are customized to the codebase. The first rule focuses on detecting a common API misuse pattern that can make Ruby applications susceptible to SQL injection. This is a generic rule and can be used without modification on most Rails applications. The second rule ensures the correct use of Pundit authorization in a Rails application on specified models. This is more of a “rule template” than a complete rule, and needs a bit of customization based on the codebase being scanned. Before delving into the Pundit authorization check, let’s begin with the simpler rule tailored to identify potential SQL injection. This rule primarily targets the misuse of the sql_sanitize family of

In this blog post, we’ll go over the construction and tuning of a few Semgrep rules I created while looking at a Ruby on Rails application. Semgrep is a powerful code analysis tool, and while there are a fair number of community rules, the default rules don’t cover everything, and you get a lot more mileage when rules are customized to the codebase. The first rule focuses on detecting a common API misuse pattern that can make Ruby applications susceptible to SQL injection. This is a generic rule and can be used without modification on most Rails applications. The second rule ensures the correc

related reading