├── .github └── workflows │ └── main.yml ├── MIT-LICENSE ├── README.md ├── generate-github.sh ├── generate.sh ├── rails3 ├── .gitignore ├── Gemfile ├── Gemfile.lock ├── Rakefile ├── app │ ├── assets │ │ ├── images │ │ │ └── rails.png │ │ ├── javascripts │ │ │ ├── application.js │ │ │ └── bootstrap.js.coffee │ │ └── stylesheets │ │ │ ├── application.css │ │ │ └── bootstrap_and_overrides.css.less │ ├── controllers │ │ ├── application_controller.rb │ │ └── query_controller.rb │ ├── helpers │ │ └── application_helper.rb │ ├── mailers │ │ └── .gitkeep │ ├── models │ │ ├── .gitkeep │ │ ├── order.rb │ │ ├── queries.rb │ │ └── user.rb │ └── views │ │ ├── layouts │ │ ├── application.html.erb │ │ └── examples.html.erb │ │ └── query │ │ ├── _error.html.erb │ │ ├── _example.html.erb │ │ ├── _query.html.erb │ │ ├── _result.html.erb │ │ ├── examples.html.erb │ │ └── index.html.erb ├── config.ru ├── config │ ├── application.rb │ ├── boot.rb │ ├── database.yml │ ├── environment.rb │ ├── environments │ │ ├── development.rb │ │ ├── production.rb │ │ └── test.rb │ ├── initializers │ │ ├── backtrace_silencers.rb │ │ ├── inflections.rb │ │ ├── logger.rb │ │ ├── mime_types.rb │ │ ├── secret_token.rb │ │ ├── session_store.rb │ │ └── wrap_parameters.rb │ ├── locales │ │ └── en.yml │ └── routes.rb ├── db │ ├── migrate │ │ ├── 20130201060049_create_users.rb │ │ └── 20130201060409_create_orders.rb │ ├── schema.rb │ └── seeds.rb ├── doc │ └── README_FOR_APP ├── lib │ ├── assets │ │ └── .gitkeep │ └── tasks │ │ └── .gitkeep ├── log │ └── .gitkeep ├── public │ ├── 404.html │ ├── 422.html │ ├── 500.html │ ├── favicon.ico │ └── robots.txt ├── script │ └── rails ├── test │ ├── fixtures │ │ ├── .gitkeep │ │ ├── orders.yml │ │ └── users.yml │ ├── functional │ │ └── .gitkeep │ ├── integration │ │ └── .gitkeep │ ├── performance │ │ └── browsing_test.rb │ ├── test_helper.rb │ └── unit │ │ ├── .gitkeep │ │ ├── order_test.rb │ │ └── user_test.rb └── vendor │ ├── assets │ ├── javascripts │ │ └── .gitkeep │ └── stylesheets │ │ └── .gitkeep │ └── plugins │ └── .gitkeep ├── rails4 ├── .gitignore ├── Gemfile ├── Gemfile.lock ├── README.rdoc ├── Rakefile ├── app │ ├── assets │ │ ├── images │ │ │ └── .keep │ │ ├── javascripts │ │ │ ├── application.js │ │ │ └── bootstrap.js.coffee │ │ └── stylesheets │ │ │ ├── application.css │ │ │ ├── bootstrap_and_overrides.css │ │ │ └── bootstrap_and_overrides.css.less │ ├── controllers │ │ ├── application_controller.rb │ │ ├── concerns │ │ │ └── .keep │ │ └── query_controller.rb │ ├── helpers │ │ └── application_helper.rb │ ├── mailers │ │ └── .keep │ ├── models │ │ ├── .keep │ │ ├── concerns │ │ │ └── .keep │ │ ├── order.rb │ │ ├── queries.rb │ │ └── user.rb │ └── views │ │ ├── layouts │ │ ├── application.html.erb │ │ └── examples.html.erb │ │ └── query │ │ ├── _error.html.erb │ │ ├── _example.html.erb │ │ ├── _query.html.erb │ │ ├── _result.html.erb │ │ ├── examples.html.erb │ │ └── index.html.erb ├── bin │ ├── bundle │ ├── rails │ ├── rake │ ├── setup │ └── spring ├── config.ru ├── config │ ├── application.rb │ ├── boot.rb │ ├── database.yml │ ├── environment.rb │ ├── environments │ │ ├── development.rb │ │ ├── production.rb │ │ └── test.rb │ ├── initializers │ │ ├── assets.rb │ │ ├── backtrace_silencers.rb │ │ ├── cookies_serializer.rb │ │ ├── filter_parameter_logging.rb │ │ ├── inflections.rb │ │ ├── logger.rb │ │ ├── mime_types.rb │ │ ├── session_store.rb │ │ └── wrap_parameters.rb │ ├── locales │ │ ├── en.bootstrap.yml │ │ └── en.yml │ ├── routes.rb │ └── secrets.yml ├── db │ ├── migrate │ │ ├── 20130201060049_create_users.rb │ │ └── 20130201060409_create_orders.rb │ ├── schema.rb │ └── seeds.rb ├── lib │ ├── assets │ │ └── .keep │ └── tasks │ │ └── .keep ├── log │ └── .keep ├── public │ ├── 404.html │ ├── 422.html │ ├── 500.html │ ├── assets │ │ └── .sprockets-manifest-2c58fd4dd142f3513e32b601398ec321.json │ ├── favicon.ico │ └── robots.txt ├── test │ ├── controllers │ │ └── .keep │ ├── fixtures │ │ └── .keep │ ├── helpers │ │ └── .keep │ ├── integration │ │ └── .keep │ ├── mailers │ │ └── .keep │ ├── models │ │ └── .keep │ └── test_helper.rb └── vendor │ └── assets │ ├── javascripts │ └── .keep │ └── stylesheets │ └── .keep ├── rails5 ├── .gitignore ├── Gemfile ├── Gemfile.lock ├── Rakefile ├── app │ ├── assets │ │ ├── images │ │ │ └── .keep │ │ ├── javascripts │ │ │ ├── application.js │ │ │ └── bootstrap.js.coffee │ │ └── stylesheets │ │ │ ├── application.css │ │ │ ├── bootstrap_and_overrides.css │ │ │ └── bootstrap_and_overrides.css.less │ ├── controllers │ │ ├── application_controller.rb │ │ ├── concerns │ │ │ └── .keep │ │ └── query_controller.rb │ ├── helpers │ │ └── application_helper.rb │ ├── mailers │ │ └── .keep │ ├── models │ │ ├── .keep │ │ ├── concerns │ │ │ └── .keep │ │ ├── order.rb │ │ ├── queries.rb │ │ └── user.rb │ └── views │ │ ├── layouts │ │ ├── application.html.erb │ │ └── examples.html.erb │ │ └── query │ │ ├── _error.html.erb │ │ ├── _example.html.erb │ │ ├── _query.html.erb │ │ ├── _result.html.erb │ │ ├── examples.html.erb │ │ └── index.html.erb ├── bin │ ├── bundle │ ├── rails │ ├── rake │ ├── setup │ ├── spring │ └── update ├── config.ru ├── config │ ├── application.rb │ ├── boot.rb │ ├── cable.yml │ ├── database.yml │ ├── environment.rb │ ├── environments │ │ ├── development.rb │ │ ├── production.rb │ │ └── test.rb │ ├── initializers │ │ ├── application_controller_renderer.rb │ │ ├── assets.rb │ │ ├── backtrace_silencers.rb │ │ ├── cookies_serializer.rb │ │ ├── filter_parameter_logging.rb │ │ ├── inflections.rb │ │ ├── logger.rb │ │ ├── mime_types.rb │ │ ├── new_framework_defaults.rb │ │ ├── session_store.rb │ │ └── wrap_parameters.rb │ ├── locales │ │ ├── en.bootstrap.yml │ │ └── en.yml │ ├── puma.rb │ ├── routes.rb │ ├── secrets.yml │ └── spring.rb ├── db │ ├── migrate │ │ ├── 20130201060049_create_users.rb │ │ └── 20130201060409_create_orders.rb │ ├── schema.rb │ └── seeds.rb ├── lib │ ├── assets │ │ └── .keep │ └── tasks │ │ └── .keep ├── log │ └── .keep ├── public │ ├── 404.html │ ├── 422.html │ ├── 500.html │ ├── favicon.ico │ └── robots.txt ├── test │ ├── controllers │ │ └── .keep │ ├── fixtures │ │ └── .keep │ ├── helpers │ │ └── .keep │ ├── integration │ │ └── .keep │ ├── mailers │ │ └── .keep │ ├── models │ │ └── .keep │ └── test_helper.rb └── vendor │ └── assets │ ├── javascripts │ └── .keep │ └── stylesheets │ └── .keep └── rails6 ├── .gitattributes ├── .gitignore ├── .ruby-version ├── Gemfile ├── Gemfile.lock ├── README.md ├── Rakefile ├── app ├── assets │ ├── config │ │ └── manifest.js │ ├── images │ │ └── .keep │ ├── javascripts │ │ ├── application.js │ │ └── bootstrap.js │ └── stylesheets │ │ ├── application.css │ │ ├── bootstrap_and_overrides.css │ │ └── bootstrap_and_overrides.css.less ├── controllers │ ├── application_controller.rb │ ├── concerns │ │ └── .keep │ └── query_controller.rb ├── helpers │ └── application_helper.rb ├── javascript │ ├── .keep │ └── application.js ├── models │ ├── application_record.rb │ ├── concerns │ │ └── .keep │ ├── order.rb │ ├── queries.rb │ └── user.rb └── views │ ├── layouts │ ├── application.html.erb │ └── examples.html.erb │ └── query │ ├── _error.html.erb │ ├── _example.html.erb │ ├── _query.html.erb │ ├── _result.html.erb │ ├── examples.html.erb │ ├── index.html.erb │ └── query.js.erb ├── bin ├── bundle ├── rails ├── rake └── setup ├── config.ru ├── config ├── application.rb ├── boot.rb ├── credentials.yml.enc ├── database.yml ├── environment.rb ├── environments │ ├── development.rb │ ├── production.rb │ └── test.rb ├── initializers │ ├── application_controller_renderer.rb │ ├── assets.rb │ ├── backtrace_silencers.rb │ ├── content_security_policy.rb │ ├── cookies_serializer.rb │ ├── filter_parameter_logging.rb │ ├── inflections.rb │ ├── logger.rb │ ├── mime_types.rb │ ├── permissions_policy.rb │ └── wrap_parameters.rb ├── locales │ ├── en.bootstrap.yml │ └── en.yml ├── master.key ├── puma.rb └── routes.rb ├── db ├── schema.rb └── seeds.rb ├── lib ├── assets │ └── .keep └── tasks │ └── .keep ├── log └── .keep ├── public ├── 404.html ├── 422.html ├── 500.html ├── apple-touch-icon-precomposed.png ├── apple-touch-icon.png ├── favicon.ico └── robots.txt ├── test ├── controllers │ └── .keep ├── fixtures │ └── files │ │ └── .keep ├── helpers │ └── .keep ├── integration │ └── .keep ├── models │ └── .keep └── test_helper.rb └── vendor └── .keep /.github/workflows/main.yml: -------------------------------------------------------------------------------- 1 | name: CI 2 | 3 | on: [push, pull_request] 4 | 5 | jobs: 6 | build: 7 | 8 | runs-on: ubuntu-latest 9 | 10 | steps: 11 | - name: Install sqlite 12 | run: sudo apt-get install libsqlite3-dev 13 | - uses: actions/checkout@v1 14 | - name: Set up Ruby 2.5 15 | uses: actions/setup-ruby@v1 16 | with: 17 | ruby-version: 2.5.x 18 | - name: Run build 19 | env: 20 | GITHUB_TOKEN: ${{ secrets.PERSONAL_TOKEN }} 21 | run: bash ./generate-github.sh 22 | -------------------------------------------------------------------------------- /MIT-LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License 2 | 3 | Copyright (c) 2012, Twitter, Inc. 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in 13 | all copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | THE SOFTWARE. 22 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ## Inject Some SQL 2 | 3 | These are sample Rails applications for demonstrating many ways SQL can be injected in Rails. 4 | 5 | ### Setup 6 | 7 | Clone the repo: 8 | 9 | ``` 10 | git clone https://github.com/presidentbeef/inject-some-sql.git 11 | ``` 12 | 13 | Pick either Rails 5, Rails 4 or Rails 3. They each have their own subdirectory. 14 | 15 | ``` 16 | cd inject-some-sql/rails5 17 | ``` 18 | 19 | In the subdirectory, install dependences and set up the database: 20 | 21 | ``` 22 | bundle install 23 | rake db:setup db:seed 24 | ``` 25 | 26 | ### Run 27 | 28 | Typical Rails start: 29 | 30 | ``` 31 | rails s 32 | ``` 33 | 34 | Open up [localhost:3000](http://localhost:3000) in a browser. 35 | 36 | ### Reset Database 37 | 38 | It's easy to mess up a database with SQL injection. The server does attempt to 39 | reset the database after each query, but that isn't foolproof. 40 | 41 | To completely reset: 42 | 43 | ``` 44 | rake db:drop db:migrate db:seed 45 | ``` 46 | 47 | ### Inject SQL! 48 | 49 | The site lists a whole bunch of ActiveRecord queries. 50 | 51 | Each query has input for a single parameter (although some queries may actually 52 | have more than one). A sample injection is provided. Clicking "Run!" will run 53 | the query shown. 54 | 55 | ## Adding/Modifying Queries 56 | 57 | All queries are generated from `app/models/queries.rb`. 58 | 59 | ## Limitations 60 | 61 | * This is a single player game because the SQL query is stored in a global variable. 62 | 63 | ## License 64 | 65 | This code is made available under the MIT license. 66 | -------------------------------------------------------------------------------- /generate.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash --login 2 | set -e 3 | 4 | #git checkout master 5 | rm -rf tmp/ 6 | mkdir tmp 7 | mkdir tmp/assets 8 | export RAILS_ENV=production 9 | export USE_RUBY=2.5.5 10 | rvm install $USE_RUBY 11 | rvm $USE_RUBY gemset create iss 12 | 13 | rvm --force $USE_RUBY@iss gemset empty 14 | rvm $USE_RUBY@iss do gem install bundler 15 | cd rails3 16 | rvm $USE_RUBY@iss do bundle install 17 | rvm $USE_RUBY@iss do bundle exec rake assets:precompile 18 | rvm $USE_RUBY@iss do bundle exec rake db:reset 19 | rvm $USE_RUBY@iss do bundle exec rake db:setup 20 | rvm $USE_RUBY@iss do bundle exec rails s & 21 | sleep 10 22 | wget -p http://localhost:3000/examples 23 | kill %1 24 | cp localhost\:3000/examples ../tmp/rails3.html 25 | cp -rf localhost\:3000/assets/* ../tmp/assets/ 26 | rm -rf localhost\:3000 27 | cd .. 28 | 29 | echo "NOW RAILS 4" 30 | 31 | rvm --force $USE_RUBY@iss gemset empty 32 | rvm $USE_RUBY@iss do gem install bundler 33 | cd rails4 34 | rvm $USE_RUBY@iss do bundle install 35 | rvm $USE_RUBY@iss do bundle exec rake assets:precompile 36 | rvm $USE_RUBY@iss do bundle exec rake db:reset 37 | rvm $USE_RUBY@iss do bundle exec rake db:setup 38 | rvm $USE_RUBY@iss do bundle exec rails s & 39 | sleep 10 40 | wget -p http://localhost:3000/examples 41 | kill %1 42 | cp localhost\:3000/examples ../tmp/rails4.html 43 | cp -rf localhost\:3000/assets/* ../tmp/assets/ 44 | rm -rf localhost\:3000 45 | cd .. 46 | 47 | echo "NOW RAILS 5" 48 | export DISABLE_DATABASE_ENVIRONMENT_CHECK=1 49 | rvm --force $USE_RUBY@iss gemset empty 50 | rvm $USE_RUBY@iss do gem install bundler 51 | cd rails5 52 | rvm $USE_RUBY@iss do bundle install 53 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails assets:clobber 54 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails assets:precompile 55 | RAILS_ENV=production rvm $USE_RUBY@iss do rails db:environment:set RAILS_ENV=production 56 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails db:reset 57 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails db:setup 58 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails s & 59 | sleep 10 60 | wget -p http://localhost:3000/examples 61 | kill %1 62 | cp localhost\:3000/examples ../tmp/rails5.html 63 | cp -rf localhost\:3000/assets/* ../tmp/assets/ 64 | rm -rf localhost\:3000 65 | cd .. 66 | 67 | echo "NOW RAILS 6" 68 | 69 | rvm --force $USE_RUBY@iss gemset empty 70 | rvm $USE_RUBY@iss do gem install bundler 71 | cd rails6 72 | rvm $USE_RUBY@iss do bundle install 73 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails assets:clobber 74 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails assets:precompile 75 | RAILS_ENV=production rvm $USE_RUBY@iss do rails db:environment:set RAILS_ENV=production 76 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails db:schema:load 77 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails db:seed 78 | RAILS_ENV=production rvm $USE_RUBY@iss do bundle exec rails s & 79 | sleep 10 80 | wget -p http://localhost:3000/examples 81 | kill %1 82 | cp localhost\:3000/examples ../tmp/rails6.html 83 | cp localhost\:3000/examples ../tmp/index.html 84 | cp -rf localhost\:3000/assets/* ../tmp/assets/ 85 | rm -rf localhost\:3000 86 | cd .. 87 | 88 | git reset --hard 89 | git checkout gh-pages 90 | rm -rf assets 91 | mv tmp/* . 92 | rm -rf tmp 93 | 94 | git add index.html rails3.html rails4.html rails5.html rails6.html assets/ 95 | echo "To deploy:" 96 | echo "git commit && git push" 97 | -------------------------------------------------------------------------------- /rails3/.gitignore: -------------------------------------------------------------------------------- 1 | # See http://help.github.com/ignore-files/ for more about ignoring files. 2 | # 3 | # If you find yourself ignoring temporary files generated by your text editor 4 | # or operating system, you probably want to add a global ignore instead: 5 | # git config --global core.excludesfile ~/.gitignore_global 6 | 7 | # Ignore bundler config 8 | /.bundle 9 | 10 | # Ignore the default SQLite database. 11 | /db/*.sqlite3 12 | 13 | # Ignore all logfiles and tempfiles. 14 | /log/*.log 15 | /tmp 16 | /public/assets/ 17 | -------------------------------------------------------------------------------- /rails3/Gemfile: -------------------------------------------------------------------------------- 1 | source 'https://rubygems.org' 2 | 3 | gem 'rails', '~>3.2' 4 | gem 'sqlite3', '~> 1.3.6' 5 | 6 | gem 'jquery-rails' 7 | gem 'coderay', "~> 1.0.8" 8 | gem 'rdiscount' 9 | 10 | group :assets do 11 | gem 'sass-rails' 12 | gem 'coffee-rails' 13 | 14 | gem 'therubyracer', :platforms => :ruby 15 | 16 | gem 'twitter-bootstrap-rails', '~> 2.2.8' 17 | gem 'less-rails' 18 | gem 'uglifier', '>= 1.0.3' 19 | end 20 | -------------------------------------------------------------------------------- /rails3/Rakefile: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env rake 2 | # Add your own tasks in files placed in lib/tasks ending in .rake, 3 | # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake. 4 | 5 | require File.expand_path('../config/application', __FILE__) 6 | 7 | BadSql::Application.load_tasks 8 | -------------------------------------------------------------------------------- /rails3/app/assets/images/rails.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/app/assets/images/rails.png -------------------------------------------------------------------------------- /rails3/app/assets/javascripts/application.js: -------------------------------------------------------------------------------- 1 | // This is a manifest file that'll be compiled into application.js, which will include all the files 2 | // listed below. 3 | // 4 | // Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts, 5 | // or vendor/assets/javascripts of plugins, if any, can be referenced here using a relative path. 6 | // 7 | // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the 8 | // the compiled file. 9 | // 10 | // WARNING: THE FIRST BLANK LINE MARKS THE END OF WHAT'S TO BE PROCESSED, ANY BLANK LINE SHOULD 11 | // GO AFTER THE REQUIRES BELOW. 12 | // 13 | //= require jquery 14 | //= require jquery_ujs 15 | //= require twitter/bootstrap 16 | //= require_tree . 17 | -------------------------------------------------------------------------------- /rails3/app/assets/javascripts/bootstrap.js.coffee: -------------------------------------------------------------------------------- 1 | jQuery -> 2 | $("a[rel=popover]").popover() 3 | $(".tooltip").tooltip() 4 | $("a[rel=tooltip]").tooltip() -------------------------------------------------------------------------------- /rails3/app/assets/stylesheets/application.css: -------------------------------------------------------------------------------- 1 | /* 2 | * This is a manifest file that'll be compiled into application.css, which will include all the files 3 | * listed below. 4 | * 5 | * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets, 6 | * or vendor/assets/stylesheets of plugins, if any, can be referenced here using a relative path. 7 | * 8 | * You're free to add application-wide styles to this file and they'll appear at the top of the 9 | * compiled file, but it's generally better to create a new file per style scope. 10 | * 11 | *= require_self 12 | *= require_tree . 13 | */ 14 | 15 | body { 16 | margin-top: 40px; 17 | } 18 | -------------------------------------------------------------------------------- /rails3/app/assets/stylesheets/bootstrap_and_overrides.css.less: -------------------------------------------------------------------------------- 1 | @import "twitter/bootstrap/responsive"; 2 | 3 | // Set the correct sprite paths 4 | @iconSpritePath: asset-path("twitter/bootstrap/glyphicons-halflings"); 5 | @iconWhiteSpritePath: asset-path("twitter/bootstrap/glyphicons-halflings-white"); 6 | 7 | // Set the Font Awesome (Font Awesome is default. You can disable by commenting below lines) 8 | @fontAwesomeEotPath: asset-url("fontawesome-webfont.eot"); 9 | @fontAwesomeEotPath_iefix: asset-url("fontawesome-webfont.eot#iefix"); 10 | @fontAwesomeWoffPath: asset-url("fontawesome-webfont.woff"); 11 | @fontAwesomeTtfPath: asset-url("fontawesome-webfont.ttf"); 12 | @fontAwesomeSvgPath: asset-url("fontawesome-webfont.svg#fontawesomeregular"); 13 | 14 | // Font Awesome 15 | @import "fontawesome/font-awesome"; 16 | 17 | // Glyphicons 18 | //@import "twitter/bootstrap/sprites.less"; 19 | 20 | // Your custom LESS stylesheets goes here 21 | // 22 | // Since bootstrap was imported above you have access to its mixins which 23 | // you may use and inherit here 24 | // 25 | // If you'd like to override bootstrap's own variables, you can do so here as well 26 | // See http://twitter.github.com/bootstrap/customize.html#variables for their names and documentation 27 | // 28 | // Example: 29 | // @linkColor: #ff0000; 30 | 31 | body { padding-top: 60px; } 32 | -------------------------------------------------------------------------------- /rails3/app/controllers/application_controller.rb: -------------------------------------------------------------------------------- 1 | class ApplicationController < ActionController::Base 2 | protect_from_forgery 3 | end 4 | -------------------------------------------------------------------------------- /rails3/app/controllers/query_controller.rb: -------------------------------------------------------------------------------- 1 | class QueryController < ApplicationController 2 | after_filter :reset_database, :except => [:index, :examples] 3 | 4 | def index 5 | @queries = Queries 6 | end 7 | 8 | def examples 9 | @queries = Queries.map do |q| 10 | params[q[:input][:name]] = q[:input][:example] 11 | 12 | result = q.dup 13 | 14 | begin 15 | result[:result] = eval(q[:query]).inspect 16 | rescue => e 17 | result[:result] = e 18 | end 19 | 20 | params[q[:input][:name]] = nil 21 | result[:sql] = last_sql 22 | 23 | reset_database 24 | 25 | result 26 | end 27 | 28 | render :layout => 'examples' 29 | end 30 | 31 | Queries.each do |query| 32 | class_eval <<-RUBY 33 | def #{query[:action]} 34 | begin 35 | show #{query[:query]} 36 | rescue => e 37 | @error = e 38 | @sql = last_sql 39 | render :partial => 'error' 40 | end 41 | end 42 | RUBY 43 | end 44 | 45 | private 46 | 47 | def show query 48 | @sql = last_sql 49 | render :partial => 'result', :locals => { :query => query } 50 | end 51 | 52 | def last_sql 53 | sql = $last_sql 54 | $last_sql = nil 55 | sql 56 | end 57 | 58 | def reset_database 59 | Order.delete_all 60 | User.delete_all 61 | load File.join(Rails.root, 'db/seeds.rb') 62 | end 63 | end 64 | -------------------------------------------------------------------------------- /rails3/app/helpers/application_helper.rb: -------------------------------------------------------------------------------- 1 | require 'coderay' 2 | require 'rdiscount' 3 | 4 | module ApplicationHelper 5 | def ruby_color code 6 | CodeRay.scan(code, :ruby).span.html_safe 7 | end 8 | 9 | def sql_color code 10 | CodeRay.scan(code, :sql).span.html_safe 11 | end 12 | 13 | def md markdown 14 | RDiscount.new(markdown).to_html.html_safe 15 | end 16 | end 17 | -------------------------------------------------------------------------------- /rails3/app/mailers/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/app/mailers/.gitkeep -------------------------------------------------------------------------------- /rails3/app/models/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/app/models/.gitkeep -------------------------------------------------------------------------------- /rails3/app/models/order.rb: -------------------------------------------------------------------------------- 1 | class Order < ActiveRecord::Base 2 | attr_accessible :total, :user_id 3 | belongs_to :user 4 | end 5 | -------------------------------------------------------------------------------- /rails3/app/models/user.rb: -------------------------------------------------------------------------------- 1 | class User < ActiveRecord::Base 2 | attr_accessible :admin, :name, :password, :age 3 | has_many :orders 4 | end 5 | -------------------------------------------------------------------------------- /rails3/app/views/layouts/application.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails SQL Injection Examples 5 | <%= stylesheet_link_tag "application", :media => "all" %> 6 | <%= javascript_include_tag "application" %> 7 | <%= csrf_meta_tags %> 8 | 21 | 22 | 23 |
24 |
25 |
26 | 27 | 28 | 29 | 30 | 31 | Inject Some SQL 32 |
33 |
    34 |
  • <%= link_to "Clear Results", 'javascript:void(0)', id: "clear" %>
    • 35 |
36 |
37 |
38 |
39 |
40 | 41 |
42 | <%= yield %> 43 |
44 | 45 | 46 | -------------------------------------------------------------------------------- /rails3/app/views/layouts/examples.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails SQL Injection Examples 5 | 6 | <%= stylesheet_link_tag "application", :media => "all" %> 7 | <%= javascript_include_tag "application" %> 8 | <%= csrf_meta_tags %> 9 | 10 | 11 |
12 |
13 |
14 | 15 | 16 | 17 | 18 | 19 | Rails SQL Injection 20 |
21 | 28 | 29 |
    30 | 36 |
37 |
38 | 39 |
40 |
41 |
42 | 43 |
44 | <%= yield %> 45 |
46 |
47 |
48 |

More Resources

49 |

50 | This site is brought to you by the folks at Brakeman Pro. 51 |

52 |

53 | More information about Rails security: 54 |

55 | 62 |

63 | This site is also available as a Rails application. To interact with this site dynamically and try out different SQL injection attacks you can clone the code and run it locally. Contributions and corrections are welcome! 64 |

65 |
66 | 67 | 68 | -------------------------------------------------------------------------------- /rails3/app/views/query/_error.html.erb: -------------------------------------------------------------------------------- 1 |
2 | <% if @sql %> 3 |
4 | Query 5 |
6 | <%= @sql %> 7 |
8 |
9 | <% end %> 10 | 11 |
12 | Error 13 |
14 | <%= @error %> 15 |
16 |
17 |
18 | -------------------------------------------------------------------------------- /rails3/app/views/query/_example.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 |

4 | Documentation 5 |

6 |
7 | 8 |

<%= query[:name] || query[:action] %>

9 | 10 |
11 | <%= md query[:desc] if query[:desc] %> 12 |
13 | 14 |

Example

15 |

16 | <%= md query[:example] if query[:example] %> 17 |

18 | 19 |
20 | 
21 | <%= ruby_color "params[:#{query[:input][:name]}] = #{query[:input][:example].inspect}" %>
22 | <%= ruby_color query[:query] %>
23 |
24 | 25 |
26 | Query 27 |
28 | <%= sql_color query[:sql] %> 29 |
30 | Result 31 |
32 | <%= query[:result] %> 33 |
34 |
35 |
36 | -------------------------------------------------------------------------------- /rails3/app/views/query/_query.html.erb: -------------------------------------------------------------------------------- 1 |
2 | <%= form_tag("/query/#{query[:action]}", :remote => true, :update => "#{query[:name]}result") do %> 3 |
4 | <%= query[:name] || query[:action] %> 5 | 6 |
7 | <%= ruby_color query[:query] %> 8 |
9 | 10 | <% if input = query[:input] %> 11 |
12 |
13 | <%= input[:name].capitalize %> 14 | <%= text_field_tag input[:name], input[:example], :class => 'text_field input-xlarge' %> 15 | 16 | <%= submit_tag "Run!", :class => 'btn' %> 17 |
18 |
19 | 20 | <% end %> 21 | <% end %> 22 |
23 | 24 |
25 |
26 | 27 |
28 | -------------------------------------------------------------------------------- /rails3/app/views/query/_result.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 | Query 4 |
5 | <%= sql_color @sql %> 6 |
7 |
8 | 9 |
10 | Result 11 |
12 | <%= query.inspect %> 13 |
14 |
15 | 16 |
17 | Params 18 |
19 | <%= params.inspect %> 20 |
21 |
22 | 23 | 24 |
25 | -------------------------------------------------------------------------------- /rails3/app/views/query/examples.html.erb: -------------------------------------------------------------------------------- 1 |

Overview

2 |

3 | The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. 4 |

5 |

6 | This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not include SQL injection from known CVEs and are not vulnerabilities themselves, only potential misuses of the methods. 7 |

8 |

9 | Please use this list as a guide of what not to do. 10 |

11 |

12 | This list is in no way exhaustive or complete! Please feel free to contribute. 13 |

14 |

Examples

15 |

16 | Each method or option described below is accompanied by an example demonstrating how the ActiveRecord interface could be exploited if used unsafely. These are not necessarily the worst exploits, they represent just a small hint of what could be accomplished if one is not careful. The examples on this page were tested with Rails 3.2.22 and SQLite 3. 17 |

18 |

Interactive Version

19 |

20 | Clone and run this site from the git repo to try out or modify the examples! 21 |

22 | 23 | <% @queries.each do |q| %> 24 | 25 | 28 | 29 | <% end %> 30 |
26 | <%= render :partial => 'example', :locals => { :query => q } %> 27 |
31 | -------------------------------------------------------------------------------- /rails3/app/views/query/index.html.erb: -------------------------------------------------------------------------------- 1 | 2 | <% @queries.each do |q| %> 3 | 4 | 7 | 8 | <% end %> 9 |
5 | <%= render :partial => 'query', :locals => { :query => q } %> 6 |
10 | -------------------------------------------------------------------------------- /rails3/config.ru: -------------------------------------------------------------------------------- 1 | # This file is used by Rack-based servers to start the application. 2 | 3 | require ::File.expand_path('../config/environment', __FILE__) 4 | run BadSql::Application 5 | -------------------------------------------------------------------------------- /rails3/config/application.rb: -------------------------------------------------------------------------------- 1 | require File.expand_path('../boot', __FILE__) 2 | 3 | require 'rails/all' 4 | 5 | if defined?(Bundler) 6 | # If you precompile assets before deploying to production, use this line 7 | Bundler.require(*Rails.groups(:assets => %w(development test))) 8 | # If you want your assets lazily compiled in production, use this line 9 | # Bundler.require(:default, :assets, Rails.env) 10 | end 11 | 12 | module BadSql 13 | class Application < Rails::Application 14 | # Settings in config/environments/* take precedence over those specified here. 15 | # Application configuration should go into files in config/initializers 16 | # -- all .rb files in that directory are automatically loaded. 17 | 18 | # Custom directories with classes and modules you want to be autoloadable. 19 | # config.autoload_paths += %W(#{config.root}/extras) 20 | 21 | # Only load the plugins named here, in the order given (default is alphabetical). 22 | # :all can be used as a placeholder for all plugins not explicitly named. 23 | # config.plugins = [ :exception_notification, :ssl_requirement, :all ] 24 | 25 | # Activate observers that should always be running. 26 | # config.active_record.observers = :cacher, :garbage_collector, :forum_observer 27 | 28 | # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone. 29 | # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC. 30 | # config.time_zone = 'Central Time (US & Canada)' 31 | 32 | # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded. 33 | # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s] 34 | # config.i18n.default_locale = :de 35 | 36 | # Configure the default encoding used in templates for Ruby 1.9. 37 | config.encoding = "utf-8" 38 | 39 | # Configure sensitive parameters which will be filtered from the log file. 40 | config.filter_parameters += [:password] 41 | 42 | # Enable escaping HTML in JSON. 43 | config.active_support.escape_html_entities_in_json = true 44 | 45 | # Use SQL instead of Active Record's schema dumper when creating the database. 46 | # This is necessary if your schema can't be completely dumped by the schema dumper, 47 | # like if you have constraints or database-specific column types 48 | # config.active_record.schema_format = :sql 49 | 50 | # Enforce whitelist mode for mass assignment. 51 | # This will create an empty whitelist of attributes available for mass-assignment for all models 52 | # in your app. As such, your models will need to explicitly whitelist or blacklist accessible 53 | # parameters by using an attr_accessible or attr_protected declaration. 54 | config.active_record.whitelist_attributes = true 55 | 56 | # Enable the asset pipeline 57 | config.assets.enabled = true 58 | 59 | # Version of your assets, change this if you want to expire all your assets 60 | config.assets.version = '1.0' 61 | end 62 | end 63 | -------------------------------------------------------------------------------- /rails3/config/boot.rb: -------------------------------------------------------------------------------- 1 | require 'rubygems' 2 | 3 | # Set up gems listed in the Gemfile. 4 | ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__) 5 | 6 | require 'bundler/setup' if File.exists?(ENV['BUNDLE_GEMFILE']) 7 | -------------------------------------------------------------------------------- /rails3/config/database.yml: -------------------------------------------------------------------------------- 1 | # SQLite version 3.x 2 | # gem install sqlite3 3 | # 4 | # Ensure the SQLite 3 gem is defined in your Gemfile 5 | # gem 'sqlite3' 6 | development: 7 | adapter: sqlite3 8 | database: db/development.sqlite3 9 | pool: 5 10 | timeout: 5000 11 | 12 | # Warning: The database defined as "test" will be erased and 13 | # re-generated from your development database when you run "rake". 14 | # Do not set this db to the same as development or production. 15 | test: 16 | adapter: sqlite3 17 | database: db/test.sqlite3 18 | pool: 5 19 | timeout: 5000 20 | 21 | production: 22 | adapter: sqlite3 23 | database: db/production.sqlite3 24 | pool: 5 25 | timeout: 5000 26 | -------------------------------------------------------------------------------- /rails3/config/environment.rb: -------------------------------------------------------------------------------- 1 | # Load the rails application 2 | require File.expand_path('../application', __FILE__) 3 | 4 | # Initialize the rails application 5 | BadSql::Application.initialize! 6 | -------------------------------------------------------------------------------- /rails3/config/environments/development.rb: -------------------------------------------------------------------------------- 1 | BadSql::Application.configure do 2 | # Settings specified here will take precedence over those in config/application.rb 3 | 4 | # In the development environment your application's code is reloaded on 5 | # every request. This slows down response time but is perfect for development 6 | # since you don't have to restart the web server when you make code changes. 7 | config.cache_classes = false 8 | 9 | # Log error messages when you accidentally call methods on nil. 10 | config.whiny_nils = true 11 | 12 | # Show full error reports and disable caching 13 | config.consider_all_requests_local = true 14 | config.action_controller.perform_caching = false 15 | 16 | # Don't care if the mailer can't send 17 | config.action_mailer.raise_delivery_errors = false 18 | 19 | # Print deprecation notices to the Rails logger 20 | config.active_support.deprecation = :log 21 | 22 | # Only use best-standards-support built into browsers 23 | config.action_dispatch.best_standards_support = :builtin 24 | 25 | # Raise exception on mass assignment protection for Active Record models 26 | config.active_record.mass_assignment_sanitizer = :strict 27 | 28 | # Log the query plan for queries taking more than this (works 29 | # with SQLite, MySQL, and PostgreSQL) 30 | config.active_record.auto_explain_threshold_in_seconds = 0.5 31 | 32 | # Do not compress assets 33 | config.assets.compress = false 34 | 35 | # Expands the lines which load the assets 36 | config.assets.debug = true 37 | end 38 | -------------------------------------------------------------------------------- /rails3/config/environments/production.rb: -------------------------------------------------------------------------------- 1 | BadSql::Application.configure do 2 | # Settings specified here will take precedence over those in config/application.rb 3 | 4 | # Code is not reloaded between requests 5 | config.cache_classes = true 6 | 7 | # Full error reports are disabled and caching is turned on 8 | config.consider_all_requests_local = false 9 | config.action_controller.perform_caching = true 10 | 11 | # Disable Rails's static asset server (Apache or nginx will already do this) 12 | config.serve_static_assets = true 13 | 14 | # Compress JavaScripts and CSS 15 | config.assets.compress = true 16 | 17 | # Don't fallback to assets pipeline if a precompiled asset is missed 18 | config.assets.compile = true 19 | 20 | # Generate digests for assets URLs 21 | config.assets.digest = true 22 | 23 | # Defaults to nil and saved in location specified by config.assets.prefix 24 | # config.assets.manifest = YOUR_PATH 25 | 26 | # Specifies the header that your server uses for sending files 27 | # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache 28 | # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for nginx 29 | 30 | # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies. 31 | # config.force_ssl = true 32 | 33 | # See everything in the log (default is :info) 34 | # config.log_level = :debug 35 | 36 | # Prepend all log lines with the following tags 37 | # config.log_tags = [ :subdomain, :uuid ] 38 | 39 | # Use a different logger for distributed setups 40 | # config.logger = ActiveSupport::TaggedLogging.new(SyslogLogger.new) 41 | 42 | # Use a different cache store in production 43 | # config.cache_store = :mem_cache_store 44 | 45 | # Enable serving of images, stylesheets, and JavaScripts from an asset server 46 | # config.action_controller.asset_host = "http://assets.example.com" 47 | 48 | # Precompile additional assets (application.js, application.css, and all non-JS/CSS are already added) 49 | # config.assets.precompile += %w( search.js ) 50 | 51 | # Disable delivery errors, bad email addresses will be ignored 52 | # config.action_mailer.raise_delivery_errors = false 53 | 54 | # Enable threaded mode 55 | # config.threadsafe! 56 | 57 | # Enable locale fallbacks for I18n (makes lookups for any locale fall back to 58 | # the I18n.default_locale when a translation can not be found) 59 | config.i18n.fallbacks = true 60 | 61 | # Send deprecation notices to registered listeners 62 | config.active_support.deprecation = :notify 63 | 64 | # Log the query plan for queries taking more than this (works 65 | # with SQLite, MySQL, and PostgreSQL) 66 | # config.active_record.auto_explain_threshold_in_seconds = 0.5 67 | end 68 | -------------------------------------------------------------------------------- /rails3/config/environments/test.rb: -------------------------------------------------------------------------------- 1 | BadSql::Application.configure do 2 | # Settings specified here will take precedence over those in config/application.rb 3 | 4 | # The test environment is used exclusively to run your application's 5 | # test suite. You never need to work with it otherwise. Remember that 6 | # your test database is "scratch space" for the test suite and is wiped 7 | # and recreated between test runs. Don't rely on the data there! 8 | config.cache_classes = true 9 | 10 | # Configure static asset server for tests with Cache-Control for performance 11 | config.serve_static_assets = true 12 | config.static_cache_control = "public, max-age=3600" 13 | 14 | # Log error messages when you accidentally call methods on nil 15 | config.whiny_nils = true 16 | 17 | # Show full error reports and disable caching 18 | config.consider_all_requests_local = true 19 | config.action_controller.perform_caching = false 20 | 21 | # Raise exceptions instead of rendering exception templates 22 | config.action_dispatch.show_exceptions = false 23 | 24 | # Disable request forgery protection in test environment 25 | config.action_controller.allow_forgery_protection = false 26 | 27 | # Tell Action Mailer not to deliver emails to the real world. 28 | # The :test delivery method accumulates sent emails in the 29 | # ActionMailer::Base.deliveries array. 30 | config.action_mailer.delivery_method = :test 31 | 32 | # Raise exception on mass assignment protection for Active Record models 33 | config.active_record.mass_assignment_sanitizer = :strict 34 | 35 | # Print deprecation notices to the stderr 36 | config.active_support.deprecation = :stderr 37 | end 38 | -------------------------------------------------------------------------------- /rails3/config/initializers/backtrace_silencers.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces. 4 | # Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ } 5 | 6 | # You can also remove all the silencers if you're trying to debug a problem that might stem from framework code. 7 | # Rails.backtrace_cleaner.remove_silencers! 8 | -------------------------------------------------------------------------------- /rails3/config/initializers/inflections.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new inflection rules using the following format 4 | # (all these examples are active by default): 5 | # ActiveSupport::Inflector.inflections do |inflect| 6 | # inflect.plural /^(ox)$/i, '\1en' 7 | # inflect.singular /^(ox)en/i, '\1' 8 | # inflect.irregular 'person', 'people' 9 | # inflect.uncountable %w( fish sheep ) 10 | # end 11 | # 12 | # These inflection rules are supported but not enabled by default: 13 | # ActiveSupport::Inflector.inflections do |inflect| 14 | # inflect.acronym 'RESTful' 15 | # end 16 | -------------------------------------------------------------------------------- /rails3/config/initializers/logger.rb: -------------------------------------------------------------------------------- 1 | if not defined? ActiveRecord::ConnectionAdapters::AbstractAdapter 2 | abort "Need to be able to override AbstractAdapter log" 3 | end 4 | 5 | class ActiveRecord::ConnectionAdapters::AbstractAdapter 6 | alias oldlog log 7 | 8 | def log sql, *args, &block 9 | $last_sql = sql 10 | oldlog sql, *args, &block 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails3/config/initializers/mime_types.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new mime types for use in respond_to blocks: 4 | # Mime::Type.register "text/richtext", :rtf 5 | # Mime::Type.register_alias "text/html", :iphone 6 | -------------------------------------------------------------------------------- /rails3/config/initializers/secret_token.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Your secret key for verifying the integrity of signed cookies. 4 | # If you change this key, all old signed cookies will become invalid! 5 | # Make sure the secret is at least 30 characters and all random, 6 | # no regular words or you'll be exposed to dictionary attacks. 7 | BadSql::Application.config.secret_token = '02f648eb8338da8c60d5dc5618fc57fc063da825e89dc8814ffaac5a05248c95d4b8352a825a4d2015759e1493a0a22ae8d7901211086ce429e2dba6990e8d50' 8 | -------------------------------------------------------------------------------- /rails3/config/initializers/session_store.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | BadSql::Application.config.session_store :cookie_store, key: '_bad_sql_session' 4 | 5 | # Use the database for sessions instead of the cookie-based default, 6 | # which shouldn't be used to store highly confidential information 7 | # (create the session table with "rails generate session_migration") 8 | # BadSql::Application.config.session_store :active_record_store 9 | -------------------------------------------------------------------------------- /rails3/config/initializers/wrap_parameters.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | # 3 | # This file contains settings for ActionController::ParamsWrapper which 4 | # is enabled by default. 5 | 6 | # Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array. 7 | ActiveSupport.on_load(:action_controller) do 8 | wrap_parameters format: [:json] 9 | end 10 | 11 | # Disable root element in JSON by default. 12 | ActiveSupport.on_load(:active_record) do 13 | self.include_root_in_json = false 14 | end 15 | -------------------------------------------------------------------------------- /rails3/config/locales/en.yml: -------------------------------------------------------------------------------- 1 | # Sample localization file for English. Add more files in this directory for other locales. 2 | # See https://github.com/svenfuchs/rails-i18n/tree/master/rails%2Flocale for starting points. 3 | 4 | en: 5 | hello: "Hello world" 6 | -------------------------------------------------------------------------------- /rails3/config/routes.rb: -------------------------------------------------------------------------------- 1 | BadSql::Application.routes.draw do 2 | match 'query/:action', controller: :query 3 | match 'examples', to: 'query#examples' 4 | root to: 'query#index' 5 | end 6 | -------------------------------------------------------------------------------- /rails3/db/migrate/20130201060049_create_users.rb: -------------------------------------------------------------------------------- 1 | class CreateUsers < ActiveRecord::Migration 2 | def change 3 | create_table :users do |t| 4 | t.string :name 5 | t.string :password 6 | t.integer :age 7 | t.boolean :admin 8 | 9 | t.timestamps 10 | end 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails3/db/migrate/20130201060409_create_orders.rb: -------------------------------------------------------------------------------- 1 | class CreateOrders < ActiveRecord::Migration 2 | def change 3 | create_table :orders do |t| 4 | t.integer :user_id 5 | t.integer :total 6 | 7 | t.timestamps 8 | end 9 | end 10 | end 11 | -------------------------------------------------------------------------------- /rails3/db/schema.rb: -------------------------------------------------------------------------------- 1 | # encoding: UTF-8 2 | # This file is auto-generated from the current state of the database. Instead 3 | # of editing this file, please use the migrations feature of Active Record to 4 | # incrementally modify your database, and then regenerate this schema definition. 5 | # 6 | # Note that this schema.rb definition is the authoritative source for your 7 | # database schema. If you need to create the application database on another 8 | # system, you should be using db:schema:load, not running all the migrations 9 | # from scratch. The latter is a flawed and unsustainable approach (the more migrations 10 | # you'll amass, the slower it'll run and the greater likelihood for issues). 11 | # 12 | # It's strongly recommended to check this file into your version control system. 13 | 14 | ActiveRecord::Schema.define(:version => 20130201060409) do 15 | 16 | create_table "orders", :force => true do |t| 17 | t.integer "user_id" 18 | t.integer "total" 19 | t.datetime "created_at", :null => false 20 | t.datetime "updated_at", :null => false 21 | end 22 | 23 | create_table "users", :force => true do |t| 24 | t.string "name" 25 | t.string "password" 26 | t.integer "age" 27 | t.boolean "admin" 28 | t.datetime "created_at", :null => false 29 | t.datetime "updated_at", :null => false 30 | end 31 | 32 | end 33 | -------------------------------------------------------------------------------- /rails3/db/seeds.rb: -------------------------------------------------------------------------------- 1 | # This file should contain all the record creation needed to seed the database with its default values. 2 | # The data can then be loaded with the rake db:seed (or created alongside the db with db:setup). 3 | # 4 | # Examples: 5 | # 6 | # cities = City.create([{ name: 'Chicago' }, { name: 'Copenhagen' }]) 7 | # Mayor.create(name: 'Emanuel', city: cities.first) 8 | 9 | ["Bob", "Jim", "Sarah", "Tina", "Tony"].each do |name| 10 | User.create :name => name, :password => "#{name}pass", :admin => false, :age => (rand(60) + 18) 11 | end 12 | 13 | User.create :name => "Admin", :password => "supersecretpass", :admin => true, :age => (rand(60) + 18) 14 | 15 | Order.create :user_id => 1, :total => 10 16 | Order.create :user_id => 3, :total => 500 17 | Order.create :user_id => 4, :total => 1 18 | -------------------------------------------------------------------------------- /rails3/doc/README_FOR_APP: -------------------------------------------------------------------------------- 1 | Use this README file to introduce your application and point to useful places in the API for learning more. 2 | Run "rake doc:app" to generate API documentation for your models, controllers, helpers, and libraries. 3 | -------------------------------------------------------------------------------- /rails3/lib/assets/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/lib/assets/.gitkeep -------------------------------------------------------------------------------- /rails3/lib/tasks/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/lib/tasks/.gitkeep -------------------------------------------------------------------------------- /rails3/log/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/log/.gitkeep -------------------------------------------------------------------------------- /rails3/public/404.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The page you were looking for doesn't exist (404) 5 | 17 | 18 | 19 | 20 | 21 |
22 |

The page you were looking for doesn't exist.

23 |

You may have mistyped the address or the page may have moved.

24 |
25 | 26 | 27 | -------------------------------------------------------------------------------- /rails3/public/422.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The change you wanted was rejected (422) 5 | 17 | 18 | 19 | 20 | 21 |
22 |

The change you wanted was rejected.

23 |

Maybe you tried to change something you didn't have access to.

24 |
25 | 26 | 27 | -------------------------------------------------------------------------------- /rails3/public/500.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | We're sorry, but something went wrong (500) 5 | 17 | 18 | 19 | 20 | 21 |
22 |

We're sorry, but something went wrong.

23 |
24 | 25 | 26 | -------------------------------------------------------------------------------- /rails3/public/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/public/favicon.ico -------------------------------------------------------------------------------- /rails3/public/robots.txt: -------------------------------------------------------------------------------- 1 | # See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file 2 | # 3 | # To ban all spiders from the entire site uncomment the next two lines: 4 | # User-Agent: * 5 | # Disallow: / 6 | -------------------------------------------------------------------------------- /rails3/script/rails: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | # This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application. 3 | 4 | APP_PATH = File.expand_path('../../config/application', __FILE__) 5 | require File.expand_path('../../config/boot', __FILE__) 6 | require 'rails/commands' 7 | -------------------------------------------------------------------------------- /rails3/test/fixtures/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/test/fixtures/.gitkeep -------------------------------------------------------------------------------- /rails3/test/fixtures/orders.yml: -------------------------------------------------------------------------------- 1 | # Read about fixtures at http://api.rubyonrails.org/classes/ActiveRecord/Fixtures.html 2 | 3 | one: 4 | user_id: 5 | total: 6 | 7 | two: 8 | user_id: 9 | total: 10 | -------------------------------------------------------------------------------- /rails3/test/fixtures/users.yml: -------------------------------------------------------------------------------- 1 | # Read about fixtures at http://api.rubyonrails.org/classes/ActiveRecord/Fixtures.html 2 | 3 | one: 4 | name: MyString 5 | password: MyString 6 | admin: false 7 | 8 | two: 9 | name: MyString 10 | password: MyString 11 | admin: false 12 | -------------------------------------------------------------------------------- /rails3/test/functional/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/test/functional/.gitkeep -------------------------------------------------------------------------------- /rails3/test/integration/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/test/integration/.gitkeep -------------------------------------------------------------------------------- /rails3/test/performance/browsing_test.rb: -------------------------------------------------------------------------------- 1 | require 'test_helper' 2 | require 'rails/performance_test_help' 3 | 4 | class BrowsingTest < ActionDispatch::PerformanceTest 5 | # Refer to the documentation for all available options 6 | # self.profile_options = { :runs => 5, :metrics => [:wall_time, :memory] 7 | # :output => 'tmp/performance', :formats => [:flat] } 8 | 9 | def test_homepage 10 | get '/' 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails3/test/test_helper.rb: -------------------------------------------------------------------------------- 1 | ENV["RAILS_ENV"] = "test" 2 | require File.expand_path('../../config/environment', __FILE__) 3 | require 'rails/test_help' 4 | 5 | class ActiveSupport::TestCase 6 | # Setup all fixtures in test/fixtures/*.(yml|csv) for all tests in alphabetical order. 7 | # 8 | # Note: You'll currently still have to declare fixtures explicitly in integration tests 9 | # -- they do not yet inherit this setting 10 | fixtures :all 11 | 12 | # Add more helper methods to be used by all tests here... 13 | end 14 | -------------------------------------------------------------------------------- /rails3/test/unit/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/test/unit/.gitkeep -------------------------------------------------------------------------------- /rails3/test/unit/order_test.rb: -------------------------------------------------------------------------------- 1 | require 'test_helper' 2 | 3 | class OrderTest < ActiveSupport::TestCase 4 | # test "the truth" do 5 | # assert true 6 | # end 7 | end 8 | -------------------------------------------------------------------------------- /rails3/test/unit/user_test.rb: -------------------------------------------------------------------------------- 1 | require 'test_helper' 2 | 3 | class UserTest < ActiveSupport::TestCase 4 | # test "the truth" do 5 | # assert true 6 | # end 7 | end 8 | -------------------------------------------------------------------------------- /rails3/vendor/assets/javascripts/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/vendor/assets/javascripts/.gitkeep -------------------------------------------------------------------------------- /rails3/vendor/assets/stylesheets/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/vendor/assets/stylesheets/.gitkeep -------------------------------------------------------------------------------- /rails3/vendor/plugins/.gitkeep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails3/vendor/plugins/.gitkeep -------------------------------------------------------------------------------- /rails4/.gitignore: -------------------------------------------------------------------------------- 1 | # See https://help.github.com/articles/ignoring-files for more about ignoring files. 2 | # 3 | # If you find yourself ignoring temporary files generated by your text editor 4 | # or operating system, you probably want to add a global ignore instead: 5 | # git config --global core.excludesfile '~/.gitignore_global' 6 | 7 | # Ignore bundler config. 8 | /.bundle 9 | 10 | # Ignore the default SQLite database. 11 | /db/*.sqlite3 12 | /db/*.sqlite3-journal 13 | 14 | # Ignore all logfiles and tempfiles. 15 | /log/* 16 | !/log/.keep 17 | /tmp 18 | /public/assets/ 19 | -------------------------------------------------------------------------------- /rails4/Gemfile: -------------------------------------------------------------------------------- 1 | source 'https://rubygems.org' 2 | 3 | gem 'rails', '~>4.2' 4 | gem 'sqlite3', '~> 1.3.6' 5 | gem 'sass-rails', '~> 5.0' 6 | gem 'uglifier', '>= 1.3.0' 7 | gem 'coffee-rails', '~> 4.1.0' 8 | 9 | gem 'jquery-rails' 10 | gem 'turbolinks' 11 | gem 'jbuilder', '~> 2.0' 12 | gem 'sdoc', '~> 0.4.0', group: :doc 13 | 14 | gem 'coderay', "~> 1.0.8" 15 | gem 'rdiscount' 16 | gem 'twitter-bootstrap-rails', '~>2.2.8' 17 | gem 'therubyracer', :platforms => :ruby 18 | 19 | group :development, :test do 20 | gem 'byebug' 21 | end 22 | 23 | group :development do 24 | gem 'web-console', '~> 2.0' 25 | end 26 | -------------------------------------------------------------------------------- /rails4/README.rdoc: -------------------------------------------------------------------------------- 1 | == README 2 | 3 | This README would normally document whatever steps are necessary to get the 4 | application up and running. 5 | 6 | Things you may want to cover: 7 | 8 | * Ruby version 9 | 10 | * System dependencies 11 | 12 | * Configuration 13 | 14 | * Database creation 15 | 16 | * Database initialization 17 | 18 | * How to run the test suite 19 | 20 | * Services (job queues, cache servers, search engines, etc.) 21 | 22 | * Deployment instructions 23 | 24 | * ... 25 | 26 | 27 | Please feel free to use a different markup language if you do not plan to run 28 | rake doc:app. 29 | -------------------------------------------------------------------------------- /rails4/Rakefile: -------------------------------------------------------------------------------- 1 | # Add your own tasks in files placed in lib/tasks ending in .rake, 2 | # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake. 3 | 4 | require File.expand_path('../config/application', __FILE__) 5 | 6 | Rails.application.load_tasks 7 | -------------------------------------------------------------------------------- /rails4/app/assets/images/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/app/assets/images/.keep -------------------------------------------------------------------------------- /rails4/app/assets/javascripts/application.js: -------------------------------------------------------------------------------- 1 | // This is a manifest file that'll be compiled into application.js, which will include all the files 2 | // listed below. 3 | // 4 | // Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts, 5 | // or any plugin's vendor/assets/javascripts directory can be referenced here using a relative path. 6 | // 7 | // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the 8 | // compiled file. 9 | // 10 | // Read Sprockets README (https://github.com/rails/sprockets#sprockets-directives) for details 11 | // about supported directives. 12 | // 13 | //= require jquery 14 | //= require jquery_ujs 15 | //= require twitter/bootstrap 16 | //= require turbolinks 17 | //= require_tree . 18 | -------------------------------------------------------------------------------- /rails4/app/assets/javascripts/bootstrap.js.coffee: -------------------------------------------------------------------------------- 1 | jQuery -> 2 | $("a[rel~=popover], .has-popover").popover() 3 | $("a[rel~=tooltip], .has-tooltip").tooltip() 4 | -------------------------------------------------------------------------------- /rails4/app/assets/stylesheets/application.css: -------------------------------------------------------------------------------- 1 | /* 2 | * This is a manifest file that'll be compiled into application.css, which will include all the files 3 | * listed below. 4 | * 5 | * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets, 6 | * or any plugin's vendor/assets/stylesheets directory can be referenced here using a relative path. 7 | * 8 | * You're free to add application-wide styles to this file and they'll appear at the bottom of the 9 | * compiled file so the styles you add here take precedence over styles defined in any styles 10 | * defined in the other CSS/SCSS files in this directory. It is generally better to create a new 11 | * file per style scope. 12 | * 13 | *= require_tree . 14 | *= require_self 15 | */ 16 | 17 | body { 18 | margin-top: 40px; 19 | } 20 | -------------------------------------------------------------------------------- /rails4/app/assets/stylesheets/bootstrap_and_overrides.css: -------------------------------------------------------------------------------- 1 | /* 2 | =require twitter-bootstrap-static/bootstrap 3 | Use Font Awesome icons (default) 4 | To use Glyphicons sprites instead of Font Awesome, replace with "require twitter-bootstrap-static/sprites" 5 | =require twitter-bootstrap-static/fontawesome 6 | */ 7 | -------------------------------------------------------------------------------- /rails4/app/assets/stylesheets/bootstrap_and_overrides.css.less: -------------------------------------------------------------------------------- 1 | // Set correct font paths 2 | @glyphiconsEotPath: font-url("glyphicons-halflings-regular.eot"); 3 | @glyphiconsEotPath_iefix: font-url("glyphicons-halflings-regular.eot?#iefix"); 4 | @glyphiconsWoffPath: font-url("glyphicons-halflings-regular.woff"); 5 | @glyphiconsTtfPath: font-url("glyphicons-halflings-regular.ttf"); 6 | @glyphiconsSvgPath: font-url("glyphicons-halflings-regular.svg#glyphicons_halflingsregular"); 7 | 8 | // Set the Font Awesome (Font Awesome is default. You can disable by commenting below lines) 9 | @fontAwesomeEotPath: font-url("fontawesome-webfont.eot"); 10 | @fontAwesomeEotPath_iefix: font-url("fontawesome-webfont.eot?#iefix"); 11 | @fontAwesomeWoffPath: font-url("fontawesome-webfont.woff"); 12 | @fontAwesomeTtfPath: font-url("fontawesome-webfont.ttf"); 13 | @fontAwesomeSvgPath: font-url("fontawesome-webfont.svg#fontawesomeregular"); 14 | 15 | // Font Awesome 16 | @import "fontawesome/font-awesome"; 17 | 18 | // Glyphicons 19 | //@import "twitter/bootstrap/glyphicons.less"; 20 | 21 | // Your custom LESS stylesheets goes here 22 | // 23 | // Since bootstrap was imported above you have access to its mixins which 24 | // you may use and inherit here 25 | // 26 | // If you'd like to override bootstrap's own variables, you can do so here as well 27 | // See http://twitter.github.com/bootstrap/customize.html#variables for their names and documentation 28 | // 29 | // Example: 30 | // @link-color: #ff0000; 31 | -------------------------------------------------------------------------------- /rails4/app/controllers/application_controller.rb: -------------------------------------------------------------------------------- 1 | class ApplicationController < ActionController::Base 2 | # Prevent CSRF attacks by raising an exception. 3 | # For APIs, you may want to use :null_session instead. 4 | protect_from_forgery with: :exception 5 | end 6 | -------------------------------------------------------------------------------- /rails4/app/controllers/concerns/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/app/controllers/concerns/.keep -------------------------------------------------------------------------------- /rails4/app/controllers/query_controller.rb: -------------------------------------------------------------------------------- 1 | class QueryController < ApplicationController 2 | after_filter :reset_database, :except => [:index, :examples] 3 | 4 | def index 5 | @queries = Queries 6 | end 7 | 8 | def examples 9 | @queries = Queries.map do |q| 10 | params[q[:input][:name]] = q[:input][:example] 11 | 12 | result = q.dup 13 | 14 | begin 15 | result[:result] = eval(q[:query]).inspect 16 | rescue => e 17 | result[:result] = e 18 | end 19 | 20 | params[q[:input][:name]] = nil 21 | result[:sql] = last_sql 22 | 23 | reset_database 24 | 25 | result 26 | end 27 | 28 | render :layout => 'examples' 29 | end 30 | 31 | Queries.each do |query| 32 | class_eval <<-RUBY 33 | def #{query[:action]} 34 | begin 35 | show #{query[:query]} 36 | rescue => e 37 | @error = e 38 | @sql = last_sql 39 | render :partial => 'error' 40 | end 41 | end 42 | RUBY 43 | end 44 | 45 | private 46 | 47 | def show query 48 | @sql = last_sql 49 | render :partial => 'result', :locals => { :query => query } 50 | end 51 | 52 | def last_sql 53 | sql = $last_sql 54 | $last_sql = nil 55 | sql 56 | end 57 | 58 | def reset_database 59 | Order.delete_all 60 | User.delete_all 61 | load File.join(Rails.root, 'db/seeds.rb') 62 | end 63 | end 64 | -------------------------------------------------------------------------------- /rails4/app/helpers/application_helper.rb: -------------------------------------------------------------------------------- 1 | require 'coderay' 2 | require 'rdiscount' 3 | 4 | module ApplicationHelper 5 | def ruby_color code 6 | CodeRay.scan(code, :ruby).span.html_safe 7 | end 8 | 9 | def sql_color code 10 | CodeRay.scan(code, :sql).span.html_safe 11 | end 12 | 13 | def md markdown 14 | RDiscount.new(markdown).to_html.html_safe 15 | end 16 | end 17 | -------------------------------------------------------------------------------- /rails4/app/mailers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/app/mailers/.keep -------------------------------------------------------------------------------- /rails4/app/models/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/app/models/.keep -------------------------------------------------------------------------------- /rails4/app/models/concerns/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/app/models/concerns/.keep -------------------------------------------------------------------------------- /rails4/app/models/order.rb: -------------------------------------------------------------------------------- 1 | class Order < ActiveRecord::Base 2 | belongs_to :user 3 | end 4 | -------------------------------------------------------------------------------- /rails4/app/models/user.rb: -------------------------------------------------------------------------------- 1 | class User < ActiveRecord::Base 2 | has_many :orders 3 | end 4 | -------------------------------------------------------------------------------- /rails4/app/views/layouts/application.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails SQL Injection Examples 5 | <%= stylesheet_link_tag "application", :media => "all" %> 6 | <%= javascript_include_tag "application" %> 7 | <%= csrf_meta_tags %> 8 | 21 | 22 | 23 |
24 |
25 |
26 | 27 | 28 | 29 | 30 | 31 | Inject Some SQL 32 |
33 |
    34 |
  • <%= link_to "Clear Results", 'javascript:void(0)', id: "clear" %>
    • 35 |
36 |
37 |
38 |
39 |
40 | 41 |
42 | <%= yield %> 43 |
44 | 45 | 46 | -------------------------------------------------------------------------------- /rails4/app/views/layouts/examples.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails SQL Injection Examples 5 | 6 | <%= stylesheet_link_tag "application", :media => "all" %> 7 | <%= javascript_include_tag "application" %> 8 | <%= csrf_meta_tags %> 9 | 10 | 11 |
12 |
13 |
14 | 15 | 16 | 17 | 18 | 19 | Rails SQL Injection 20 |
21 | 28 | 29 |
    30 | 36 |
37 |
38 |
39 |
40 |
41 | 42 |
43 | <%= yield %> 44 |
45 |
46 |
47 |

More Resources

48 |

49 | This site is brought to you by the folks at Brakeman Pro. 50 |

51 |

52 | More information about Rails security: 53 |

54 | 61 |

62 | This site is also available as a Rails application. To interact with this site dynamically and try out different SQL injection attacks you can clone the code and run it locally. Contributions and corrections are welcome! 63 |

64 |
65 | 66 | 67 | -------------------------------------------------------------------------------- /rails4/app/views/query/_error.html.erb: -------------------------------------------------------------------------------- 1 |
2 | <% if @sql %> 3 |
4 | Query 5 |
6 | <%= @sql %> 7 |
8 |
9 | <% end %> 10 | 11 |
12 | Error 13 |
14 | <%= @error %> 15 |
16 |
17 |
18 | -------------------------------------------------------------------------------- /rails4/app/views/query/_example.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 |

4 | Documentation 5 |

6 |
7 | 8 |

<%= query[:name] || query[:action] %>

9 | 10 |
11 | <%= md query[:desc] if query[:desc] %> 12 |
13 | 14 |

Example

15 |

16 | <%= md query[:example] if query[:example] %> 17 |

18 | 19 |
20 | 
21 | <%= ruby_color "params[:#{query[:input][:name]}] = #{query[:input][:example].inspect}" %>
22 | <%= ruby_color query[:query] %>
23 |
24 | 25 |
26 | Query 27 |
28 | <%= sql_color query[:sql] %> 29 |
30 | Result 31 |
32 | <%= query[:result] %> 33 |
34 |
35 |
36 | -------------------------------------------------------------------------------- /rails4/app/views/query/_query.html.erb: -------------------------------------------------------------------------------- 1 |
2 | <%= form_tag("/query/#{query[:action]}", :remote => true, :update => "#{query[:name]}result") do %> 3 |
4 | <%= query[:name] || query[:action] %> 5 | 6 |
7 | <%= ruby_color query[:query] %> 8 |
9 | 10 | <% if input = query[:input] %> 11 |
12 |
13 | <%= input[:name].capitalize %> 14 | <%= text_field_tag input[:name], input[:example], :class => 'text_field input-xlarge' %> 15 | 16 | <%= submit_tag "Run!", :class => 'btn' %> 17 |
18 |
19 | 20 | <% end %> 21 | <% end %> 22 |
23 | 24 |
25 |
26 | 27 |
28 | -------------------------------------------------------------------------------- /rails4/app/views/query/_result.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 | Query 4 |
5 | <%= sql_color @sql %> 6 |
7 |
8 | 9 |
10 | Result 11 |
12 | <%= query.inspect %> 13 |
14 |
15 | 16 |
17 | Params 18 |
19 | <%= params.inspect %> 20 |
21 |
22 | 23 | 24 |
25 | -------------------------------------------------------------------------------- /rails4/app/views/query/examples.html.erb: -------------------------------------------------------------------------------- 1 |

Overview

2 |

3 | The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. 4 |

5 |

6 | This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not include SQL injection from known CVEs and are not vulnerabilities themselves, only potential misuses of the methods. 7 |

8 |

9 | Please use this list as a guide of what not to do. 10 |

11 |

12 | This list is in no way exhaustive or complete! Please feel free to contribute. 13 |

14 |

Examples

15 |

16 | Each method or option described below is accompanied by an example demonstrating how the ActiveRecord interface could be exploited if used unsafely. These are not necessarily the worst exploits, they represent just a small hint of what could be accomplished if one is not careful. The examples on this page were tested with Rails 4.2.11.1 and SQLite 3. 17 |

18 |

Interactive Version

19 |

20 | Clone and run this site from the git repo to try out or modify the examples! 21 |

22 | 23 | <% @queries.each do |q| %> 24 | 25 | 28 | 29 | <% end %> 30 |
26 | <%= render :partial => 'example', :locals => { :query => q } %> 27 |
31 | -------------------------------------------------------------------------------- /rails4/app/views/query/index.html.erb: -------------------------------------------------------------------------------- 1 | 2 | <% @queries.each do |q| %> 3 | 4 | 7 | 8 | <% end %> 9 |
5 | <%= render :partial => 'query', :locals => { :query => q } %> 6 |
10 | -------------------------------------------------------------------------------- /rails4/bin/bundle: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__) 3 | load Gem.bin_path('bundler', 'bundle') 4 | -------------------------------------------------------------------------------- /rails4/bin/rails: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | begin 3 | load File.expand_path('../spring', __FILE__) 4 | rescue LoadError => e 5 | raise unless e.message.include?('spring') 6 | end 7 | APP_PATH = File.expand_path('../../config/application', __FILE__) 8 | require_relative '../config/boot' 9 | require 'rails/commands' 10 | -------------------------------------------------------------------------------- /rails4/bin/rake: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | begin 3 | load File.expand_path('../spring', __FILE__) 4 | rescue LoadError => e 5 | raise unless e.message.include?('spring') 6 | end 7 | require_relative '../config/boot' 8 | require 'rake' 9 | Rake.application.run 10 | -------------------------------------------------------------------------------- /rails4/bin/setup: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | require 'pathname' 3 | 4 | # path to your application root. 5 | APP_ROOT = Pathname.new File.expand_path('../../', __FILE__) 6 | 7 | Dir.chdir APP_ROOT do 8 | # This script is a starting point to setup your application. 9 | # Add necessary setup steps to this file: 10 | 11 | puts "== Installing dependencies ==" 12 | system "gem install bundler --conservative" 13 | system "bundle check || bundle install" 14 | 15 | # puts "\n== Copying sample files ==" 16 | # unless File.exist?("config/database.yml") 17 | # system "cp config/database.yml.sample config/database.yml" 18 | # end 19 | 20 | puts "\n== Preparing database ==" 21 | system "bin/rake db:setup" 22 | 23 | puts "\n== Removing old logs and tempfiles ==" 24 | system "rm -f log/*" 25 | system "rm -rf tmp/cache" 26 | 27 | puts "\n== Restarting application server ==" 28 | system "touch tmp/restart.txt" 29 | end 30 | -------------------------------------------------------------------------------- /rails4/bin/spring: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | 3 | # This file loads spring without using Bundler, in order to be fast. 4 | # It gets overwritten when you run the `spring binstub` command. 5 | 6 | unless defined?(Spring) 7 | require 'rubygems' 8 | require 'bundler' 9 | 10 | if (match = Bundler.default_lockfile.read.match(/^GEM$.*?^ (?: )*spring \((.*?)\)$.*?^$/m)) 11 | Gem.paths = { 'GEM_PATH' => [Bundler.bundle_path.to_s, *Gem.path].uniq } 12 | gem 'spring', match[1] 13 | require 'spring/binstub' 14 | end 15 | end 16 | -------------------------------------------------------------------------------- /rails4/config.ru: -------------------------------------------------------------------------------- 1 | # This file is used by Rack-based servers to start the application. 2 | 3 | require ::File.expand_path('../config/environment', __FILE__) 4 | run Rails.application 5 | -------------------------------------------------------------------------------- /rails4/config/application.rb: -------------------------------------------------------------------------------- 1 | require File.expand_path('../boot', __FILE__) 2 | 3 | require 'rails/all' 4 | 5 | # Require the gems listed in Gemfile, including any gems 6 | # you've limited to :test, :development, or :production. 7 | Bundler.require(*Rails.groups) 8 | 9 | module Rails4 10 | class Application < Rails::Application 11 | # Settings in config/environments/* take precedence over those specified here. 12 | # Application configuration should go into files in config/initializers 13 | # -- all .rb files in that directory are automatically loaded. 14 | 15 | # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone. 16 | # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC. 17 | # config.time_zone = 'Central Time (US & Canada)' 18 | 19 | # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded. 20 | # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}').to_s] 21 | # config.i18n.default_locale = :de 22 | 23 | # Do not swallow errors in after_commit/after_rollback callbacks. 24 | config.active_record.raise_in_transactional_callbacks = true 25 | end 26 | end 27 | -------------------------------------------------------------------------------- /rails4/config/boot.rb: -------------------------------------------------------------------------------- 1 | ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__) 2 | 3 | require 'bundler/setup' # Set up gems listed in the Gemfile. 4 | -------------------------------------------------------------------------------- /rails4/config/database.yml: -------------------------------------------------------------------------------- 1 | # SQLite version 3.x 2 | # gem install sqlite3 3 | # 4 | # Ensure the SQLite 3 gem is defined in your Gemfile 5 | # gem 'sqlite3' 6 | # 7 | default: &default 8 | adapter: sqlite3 9 | pool: 5 10 | timeout: 5000 11 | 12 | development: 13 | <<: *default 14 | database: db/development.sqlite3 15 | 16 | # Warning: The database defined as "test" will be erased and 17 | # re-generated from your development database when you run "rake". 18 | # Do not set this db to the same as development or production. 19 | test: 20 | <<: *default 21 | database: db/test.sqlite3 22 | 23 | production: 24 | <<: *default 25 | database: db/production.sqlite3 26 | -------------------------------------------------------------------------------- /rails4/config/environment.rb: -------------------------------------------------------------------------------- 1 | # Load the Rails application. 2 | require File.expand_path('../application', __FILE__) 3 | 4 | # Initialize the Rails application. 5 | Rails.application.initialize! 6 | -------------------------------------------------------------------------------- /rails4/config/environments/development.rb: -------------------------------------------------------------------------------- 1 | Rails.application.configure do 2 | # Settings specified here will take precedence over those in config/application.rb. 3 | 4 | # In the development environment your application's code is reloaded on 5 | # every request. This slows down response time but is perfect for development 6 | # since you don't have to restart the web server when you make code changes. 7 | config.cache_classes = false 8 | 9 | # Do not eager load code on boot. 10 | config.eager_load = false 11 | 12 | # Show full error reports and disable caching. 13 | config.consider_all_requests_local = true 14 | config.action_controller.perform_caching = false 15 | 16 | # Don't care if the mailer can't send. 17 | config.action_mailer.raise_delivery_errors = false 18 | 19 | # Print deprecation notices to the Rails logger. 20 | config.active_support.deprecation = :log 21 | 22 | # Raise an error on page load if there are pending migrations. 23 | config.active_record.migration_error = :page_load 24 | 25 | # Debug mode disables concatenation and preprocessing of assets. 26 | # This option may cause significant delays in view rendering with a large 27 | # number of complex assets. 28 | config.assets.debug = true 29 | 30 | # Asset digests allow you to set far-future HTTP expiration dates on all assets, 31 | # yet still be able to expire them through the digest params. 32 | config.assets.digest = true 33 | 34 | # Adds additional error checking when serving assets at runtime. 35 | # Checks for improperly declared sprockets dependencies. 36 | # Raises helpful error messages. 37 | config.assets.raise_runtime_errors = true 38 | 39 | # Raises error for missing translations 40 | # config.action_view.raise_on_missing_translations = true 41 | end 42 | -------------------------------------------------------------------------------- /rails4/config/environments/test.rb: -------------------------------------------------------------------------------- 1 | Rails.application.configure do 2 | # Settings specified here will take precedence over those in config/application.rb. 3 | 4 | # The test environment is used exclusively to run your application's 5 | # test suite. You never need to work with it otherwise. Remember that 6 | # your test database is "scratch space" for the test suite and is wiped 7 | # and recreated between test runs. Don't rely on the data there! 8 | config.cache_classes = true 9 | 10 | # Do not eager load code on boot. This avoids loading your whole application 11 | # just for the purpose of running a single test. If you are using a tool that 12 | # preloads Rails for running tests, you may have to set it to true. 13 | config.eager_load = false 14 | 15 | # Configure static file server for tests with Cache-Control for performance. 16 | config.serve_static_files = true 17 | config.static_cache_control = 'public, max-age=3600' 18 | 19 | # Show full error reports and disable caching. 20 | config.consider_all_requests_local = true 21 | config.action_controller.perform_caching = false 22 | 23 | # Raise exceptions instead of rendering exception templates. 24 | config.action_dispatch.show_exceptions = false 25 | 26 | # Disable request forgery protection in test environment. 27 | config.action_controller.allow_forgery_protection = false 28 | 29 | # Tell Action Mailer not to deliver emails to the real world. 30 | # The :test delivery method accumulates sent emails in the 31 | # ActionMailer::Base.deliveries array. 32 | config.action_mailer.delivery_method = :test 33 | 34 | # Randomize the order test cases are executed. 35 | config.active_support.test_order = :random 36 | 37 | # Print deprecation notices to the stderr. 38 | config.active_support.deprecation = :stderr 39 | 40 | # Raises error for missing translations 41 | # config.action_view.raise_on_missing_translations = true 42 | end 43 | -------------------------------------------------------------------------------- /rails4/config/initializers/assets.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Version of your assets, change this if you want to expire all your assets. 4 | Rails.application.config.assets.version = '1.0' 5 | 6 | # Add additional assets to the asset load path 7 | # Rails.application.config.assets.paths << Emoji.images_path 8 | 9 | # Precompile additional assets. 10 | # application.js, application.css, and all non-JS/CSS in app/assets folder are already added. 11 | # Rails.application.config.assets.precompile += %w( search.js ) 12 | -------------------------------------------------------------------------------- /rails4/config/initializers/backtrace_silencers.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces. 4 | # Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ } 5 | 6 | # You can also remove all the silencers if you're trying to debug a problem that might stem from framework code. 7 | # Rails.backtrace_cleaner.remove_silencers! 8 | -------------------------------------------------------------------------------- /rails4/config/initializers/cookies_serializer.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | Rails.application.config.action_dispatch.cookies_serializer = :json 4 | -------------------------------------------------------------------------------- /rails4/config/initializers/filter_parameter_logging.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Configure sensitive parameters which will be filtered from the log file. 4 | Rails.application.config.filter_parameters += [:password] 5 | -------------------------------------------------------------------------------- /rails4/config/initializers/inflections.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new inflection rules using the following format. Inflections 4 | # are locale specific, and you may define rules for as many different 5 | # locales as you wish. All of these examples are active by default: 6 | # ActiveSupport::Inflector.inflections(:en) do |inflect| 7 | # inflect.plural /^(ox)$/i, '\1en' 8 | # inflect.singular /^(ox)en/i, '\1' 9 | # inflect.irregular 'person', 'people' 10 | # inflect.uncountable %w( fish sheep ) 11 | # end 12 | 13 | # These inflection rules are supported but not enabled by default: 14 | # ActiveSupport::Inflector.inflections(:en) do |inflect| 15 | # inflect.acronym 'RESTful' 16 | # end 17 | -------------------------------------------------------------------------------- /rails4/config/initializers/logger.rb: -------------------------------------------------------------------------------- 1 | if not defined? ActiveRecord::ConnectionAdapters::AbstractAdapter 2 | abort "Need to be able to override AbstractAdapter log" 3 | end 4 | 5 | class ActiveRecord::ConnectionAdapters::AbstractAdapter 6 | alias oldlog log 7 | 8 | def log sql, *args, &block 9 | $last_sql = sql 10 | oldlog sql, *args, &block 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails4/config/initializers/mime_types.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new mime types for use in respond_to blocks: 4 | # Mime::Type.register "text/richtext", :rtf 5 | -------------------------------------------------------------------------------- /rails4/config/initializers/session_store.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | Rails.application.config.session_store :cookie_store, key: '_rails4_session' 4 | -------------------------------------------------------------------------------- /rails4/config/initializers/wrap_parameters.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # This file contains settings for ActionController::ParamsWrapper which 4 | # is enabled by default. 5 | 6 | # Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array. 7 | ActiveSupport.on_load(:action_controller) do 8 | wrap_parameters format: [:json] if respond_to?(:wrap_parameters) 9 | end 10 | 11 | # To enable root element in JSON for ActiveRecord objects. 12 | # ActiveSupport.on_load(:active_record) do 13 | # self.include_root_in_json = true 14 | # end 15 | -------------------------------------------------------------------------------- /rails4/config/locales/en.bootstrap.yml: -------------------------------------------------------------------------------- 1 | # Sample localization file for English. Add more files in this directory for other locales. 2 | # See https://github.com/svenfuchs/rails-i18n/tree/master/rails%2Flocale for starting points. 3 | 4 | en: 5 | breadcrumbs: 6 | application: 7 | root: "Index" 8 | pages: 9 | pages: "Pages" 10 | helpers: 11 | actions: "Actions" 12 | links: 13 | back: "Back" 14 | cancel: "Cancel" 15 | confirm: "Are you sure?" 16 | destroy: "Delete" 17 | new: "New" 18 | edit: "Edit" 19 | titles: 20 | edit: "Edit %{model}" 21 | save: "Save %{model}" 22 | new: "New %{model}" 23 | delete: "Delete %{model}" 24 | -------------------------------------------------------------------------------- /rails4/config/locales/en.yml: -------------------------------------------------------------------------------- 1 | # Files in the config/locales directory are used for internationalization 2 | # and are automatically loaded by Rails. If you want to use locales other 3 | # than English, add the necessary files in this directory. 4 | # 5 | # To use the locales, use `I18n.t`: 6 | # 7 | # I18n.t 'hello' 8 | # 9 | # In views, this is aliased to just `t`: 10 | # 11 | # <%= t('hello') %> 12 | # 13 | # To use a different locale, set it with `I18n.locale`: 14 | # 15 | # I18n.locale = :es 16 | # 17 | # This would use the information in config/locales/es.yml. 18 | # 19 | # To learn more, please read the Rails Internationalization guide 20 | # available at http://guides.rubyonrails.org/i18n.html. 21 | 22 | en: 23 | hello: "Hello world" 24 | -------------------------------------------------------------------------------- /rails4/config/routes.rb: -------------------------------------------------------------------------------- 1 | Rails4::Application.routes.draw do 2 | post 'query/:action', controller: :query 3 | get 'examples', to: 'query#examples' 4 | root 'query#index' 5 | end 6 | -------------------------------------------------------------------------------- /rails4/config/secrets.yml: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Your secret key is used for verifying the integrity of signed cookies. 4 | # If you change this key, all old signed cookies will become invalid! 5 | 6 | # Make sure the secret is at least 30 characters and all random, 7 | # no regular words or you'll be exposed to dictionary attacks. 8 | # You can use `rake secret` to generate a secure secret key. 9 | 10 | # Make sure the secrets in this file are kept private 11 | # if you're sharing your code publicly. 12 | 13 | development: 14 | secret_key_base: 854e9aed263bd748339596e586f3eee40af4f554d3629c4eb710a2cd223885c307ce677fb11e8b1037be7bbb0a054b4243390e7f2c62aa0a50801edbedc5158a 15 | 16 | test: 17 | secret_key_base: fdcc761534b2cac6efdf2e89744eef12f6a7a1830c5851a26899e169c89f61c8932ee7e8e59cffc46fcc620dedaa4fe96ddae923718fe9a511d7d580b7c4248d 18 | 19 | # Do not keep production secrets in the repository, 20 | # instead read values from the environment. 21 | # ^ There is no session data so... 22 | production: 23 | secret_key_base: fdcc761534b2cac6efdf2e89744eef12f6a7a1830c5851a26899e169c89f61c8932ee7e8e59cffc46fcc620dedaa4fe96ddae923718fe9a511d7d580b7c4248d 24 | secret_token: fdcc761534b2cac6efdd2e89744eef12f6a7a1830c5851a26899e169c89f61c8932ee7e8e59cffc46fcc620dedaa4fe96ddae923718fe9a511d7d580b7c4248d 25 | -------------------------------------------------------------------------------- /rails4/db/migrate/20130201060049_create_users.rb: -------------------------------------------------------------------------------- 1 | class CreateUsers < ActiveRecord::Migration 2 | def change 3 | create_table :users do |t| 4 | t.string :name 5 | t.string :password 6 | t.integer :age 7 | t.boolean :admin 8 | 9 | t.timestamps 10 | end 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails4/db/migrate/20130201060409_create_orders.rb: -------------------------------------------------------------------------------- 1 | class CreateOrders < ActiveRecord::Migration 2 | def change 3 | create_table :orders do |t| 4 | t.integer :user_id 5 | t.integer :total 6 | 7 | t.timestamps 8 | end 9 | end 10 | end 11 | -------------------------------------------------------------------------------- /rails4/db/schema.rb: -------------------------------------------------------------------------------- 1 | # encoding: UTF-8 2 | # This file is auto-generated from the current state of the database. Instead 3 | # of editing this file, please use the migrations feature of Active Record to 4 | # incrementally modify your database, and then regenerate this schema definition. 5 | # 6 | # Note that this schema.rb definition is the authoritative source for your 7 | # database schema. If you need to create the application database on another 8 | # system, you should be using db:schema:load, not running all the migrations 9 | # from scratch. The latter is a flawed and unsustainable approach (the more migrations 10 | # you'll amass, the slower it'll run and the greater likelihood for issues). 11 | # 12 | # It's strongly recommended that you check this file into your version control system. 13 | 14 | ActiveRecord::Schema.define(version: 20130201060409) do 15 | 16 | create_table "orders", force: :cascade do |t| 17 | t.integer "user_id" 18 | t.integer "total" 19 | t.datetime "created_at" 20 | t.datetime "updated_at" 21 | end 22 | 23 | create_table "users", force: :cascade do |t| 24 | t.string "name" 25 | t.string "password" 26 | t.integer "age" 27 | t.boolean "admin" 28 | t.datetime "created_at" 29 | t.datetime "updated_at" 30 | end 31 | 32 | end 33 | -------------------------------------------------------------------------------- /rails4/db/seeds.rb: -------------------------------------------------------------------------------- 1 | # This file should contain all the record creation needed to seed the database with its default values. 2 | # The data can then be loaded with the rake db:seed (or created alongside the db with db:setup). 3 | # 4 | # Examples: 5 | # 6 | # cities = City.create([{ name: 'Chicago' }, { name: 'Copenhagen' }]) 7 | # Mayor.create(name: 'Emanuel', city: cities.first) 8 | 9 | ["Bob", "Jim", "Sarah", "Tina", "Tony"].each do |name| 10 | User.create :name => name, :password => "#{name}pass", :admin => false, :age => (rand(60) + 18) 11 | end 12 | 13 | User.create :name => "Admin", :password => "supersecretpass", :admin => true, :age => (rand(60) + 18) 14 | 15 | Order.create :user_id => 1, :total => 10 16 | Order.create :user_id => 3, :total => 500 17 | Order.create :user_id => 4, :total => 1 18 | -------------------------------------------------------------------------------- /rails4/lib/assets/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/lib/assets/.keep -------------------------------------------------------------------------------- /rails4/lib/tasks/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/lib/tasks/.keep -------------------------------------------------------------------------------- /rails4/log/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/log/.keep -------------------------------------------------------------------------------- /rails4/public/404.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The page you were looking for doesn't exist (404) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

The page you were looking for doesn't exist.

62 |

You may have mistyped the address or the page may have moved.

63 |
64 |

If you are the application owner check the logs for more information.

65 |
66 | 67 | 68 | -------------------------------------------------------------------------------- /rails4/public/422.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The change you wanted was rejected (422) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

The change you wanted was rejected.

62 |

Maybe you tried to change something you didn't have access to.

63 |
64 |

If you are the application owner check the logs for more information.

65 |
66 | 67 | 68 | -------------------------------------------------------------------------------- /rails4/public/500.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | We're sorry, but something went wrong (500) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

We're sorry, but something went wrong.

62 |
63 |

If you are the application owner check the logs for more information.

64 |
65 | 66 | 67 | -------------------------------------------------------------------------------- /rails4/public/assets/.sprockets-manifest-2c58fd4dd142f3513e32b601398ec321.json: -------------------------------------------------------------------------------- 1 | {"files":{"images/rails-322506f9917889126e81df2833a6eecdf2e394658d53dad347e9882dd4dbf28e.png":{"logical_path":"images/rails.png","mtime":"2016-01-17T13:57:07-08:00","size":6646,"digest":"322506f9917889126e81df2833a6eecdf2e394658d53dad347e9882dd4dbf28e","integrity":"sha256-MiUG+ZF4iRJugd8oM6buzfLjlGWNU9rTR+mILdTb8o4="},"javascripts/application-a3263f511a99b5234d8ccc677c0ae776b5fd0e136c63dbfc908eb600661f3f4a.js":{"logical_path":"javascripts/application.js","mtime":"2016-01-17T13:58:02-08:00","size":376150,"digest":"a3263f511a99b5234d8ccc677c0ae776b5fd0e136c63dbfc908eb600661f3f4a","integrity":"sha256-oyY/URqZtSNNjMxnfArndrX9DhNsY9v8kI62AGYfP0o="},"stylesheets/application-f9e7c1541e1b8783561468c59162bd896007380f5a3799ef2169d3a3fdf40bed.css":{"logical_path":"stylesheets/application.css","mtime":"2016-01-17T13:57:07-08:00","size":513,"digest":"f9e7c1541e1b8783561468c59162bd896007380f5a3799ef2169d3a3fdf40bed","integrity":"sha256-+efBVB4bh4NWFGjFkWK9iWAHOA9aN5nvIWnTo/30C+0="},"stylesheets/bootstrap_and_overrides.css-c5d65f0f2b638d8804fa21023938f859baddc8433d99e9ddd57e07617df04f8f.less":{"logical_path":"stylesheets/bootstrap_and_overrides.css.less","mtime":"2016-01-17T13:57:07-08:00","size":1207,"digest":"c5d65f0f2b638d8804fa21023938f859baddc8433d99e9ddd57e07617df04f8f","integrity":"sha256-xdZfDytjjYgE+iECOTj4WbrdyEM9mend1X4HYX3wT48="},"application-52db830a003d76c5163da6d690b3ac62761c513e294a93423ccf8c559af41422.js":{"logical_path":"application.js","mtime":"2016-01-17T13:58:02-08:00","size":340375,"digest":"52db830a003d76c5163da6d690b3ac62761c513e294a93423ccf8c559af41422","integrity":"sha256-UtuDCgA9dsUWPabWkLOsYnYcUT4pSpNCPM+MVZr0FCI="},"application-e80e8f2318043e8af94dddc2adad5a4f09739a8ebb323b3ab31cd71d45fd9113.css":{"logical_path":"application.css","mtime":"2016-01-17T13:31:44-08:00","size":653,"digest":"e80e8f2318043e8af94dddc2adad5a4f09739a8ebb323b3ab31cd71d45fd9113","integrity":"sha256-6A6PIxgEPor5Td3Cra1aTwlzmo67Mjs6sxzXHUX9kRM="}},"assets":{"images/rails.png":"images/rails-322506f9917889126e81df2833a6eecdf2e394658d53dad347e9882dd4dbf28e.png","javascripts/application.js":"javascripts/application-a3263f511a99b5234d8ccc677c0ae776b5fd0e136c63dbfc908eb600661f3f4a.js","stylesheets/application.css":"stylesheets/application-f9e7c1541e1b8783561468c59162bd896007380f5a3799ef2169d3a3fdf40bed.css","stylesheets/bootstrap_and_overrides.css.less":"stylesheets/bootstrap_and_overrides.css-c5d65f0f2b638d8804fa21023938f859baddc8433d99e9ddd57e07617df04f8f.less","application.js":"application-52db830a003d76c5163da6d690b3ac62761c513e294a93423ccf8c559af41422.js","application.css":"application-e80e8f2318043e8af94dddc2adad5a4f09739a8ebb323b3ab31cd71d45fd9113.css"}} -------------------------------------------------------------------------------- /rails4/public/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/public/favicon.ico -------------------------------------------------------------------------------- /rails4/public/robots.txt: -------------------------------------------------------------------------------- 1 | # See http://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file 2 | # 3 | # To ban all spiders from the entire site uncomment the next two lines: 4 | # User-agent: * 5 | # Disallow: / 6 | -------------------------------------------------------------------------------- /rails4/test/controllers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/test/controllers/.keep -------------------------------------------------------------------------------- /rails4/test/fixtures/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/test/fixtures/.keep -------------------------------------------------------------------------------- /rails4/test/helpers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/test/helpers/.keep -------------------------------------------------------------------------------- /rails4/test/integration/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/test/integration/.keep -------------------------------------------------------------------------------- /rails4/test/mailers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/test/mailers/.keep -------------------------------------------------------------------------------- /rails4/test/models/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/test/models/.keep -------------------------------------------------------------------------------- /rails4/test/test_helper.rb: -------------------------------------------------------------------------------- 1 | ENV['RAILS_ENV'] ||= 'test' 2 | require File.expand_path('../../config/environment', __FILE__) 3 | require 'rails/test_help' 4 | 5 | class ActiveSupport::TestCase 6 | # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order. 7 | fixtures :all 8 | 9 | # Add more helper methods to be used by all tests here... 10 | end 11 | -------------------------------------------------------------------------------- /rails4/vendor/assets/javascripts/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/vendor/assets/javascripts/.keep -------------------------------------------------------------------------------- /rails4/vendor/assets/stylesheets/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails4/vendor/assets/stylesheets/.keep -------------------------------------------------------------------------------- /rails5/.gitignore: -------------------------------------------------------------------------------- 1 | # See https://help.github.com/articles/ignoring-files for more about ignoring files. 2 | # 3 | # If you find yourself ignoring temporary files generated by your text editor 4 | # or operating system, you probably want to add a global ignore instead: 5 | # git config --global core.excludesfile '~/.gitignore_global' 6 | 7 | # Ignore bundler config. 8 | /.bundle 9 | 10 | # Ignore the default SQLite database. 11 | /db/*.sqlite3 12 | /db/*.sqlite3-journal 13 | 14 | # Ignore all logfiles and tempfiles. 15 | /log/* 16 | !/log/.keep 17 | /tmp 18 | 19 | /public/assets 20 | -------------------------------------------------------------------------------- /rails5/Gemfile: -------------------------------------------------------------------------------- 1 | source 'https://rubygems.org' 2 | 3 | gem 'rails', '~>5.0.0' 4 | gem 'sqlite3', '~> 1.3.13' 5 | gem 'sass-rails', '~> 5.0' 6 | gem 'uglifier', '>= 1.3.0' 7 | gem 'coffee-rails', '~> 4.1.0' 8 | 9 | gem 'jquery-rails' 10 | gem 'turbolinks' 11 | gem 'jbuilder', '~> 2.0' 12 | gem 'sdoc', '~> 0.4.0', group: :doc 13 | 14 | gem 'coderay', "~> 1.0.8" 15 | gem 'rdiscount' 16 | gem 'twitter-bootstrap-rails', '~>2.2.8' 17 | gem 'therubyracer', :platforms => :ruby 18 | 19 | group :development, :test do 20 | gem 'byebug' 21 | end 22 | 23 | group :development do 24 | gem 'web-console', '~> 2.0' 25 | gem 'spring' 26 | end 27 | -------------------------------------------------------------------------------- /rails5/Rakefile: -------------------------------------------------------------------------------- 1 | # Add your own tasks in files placed in lib/tasks ending in .rake, 2 | # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake. 3 | 4 | require File.expand_path('../config/application', __FILE__) 5 | 6 | Rails.application.load_tasks 7 | -------------------------------------------------------------------------------- /rails5/app/assets/images/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/app/assets/images/.keep -------------------------------------------------------------------------------- /rails5/app/assets/javascripts/application.js: -------------------------------------------------------------------------------- 1 | // This is a manifest file that'll be compiled into application.js, which will include all the files 2 | // listed below. 3 | // 4 | // Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts, 5 | // or any plugin's vendor/assets/javascripts directory can be referenced here using a relative path. 6 | // 7 | // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the 8 | // compiled file. 9 | // 10 | // Read Sprockets README (https://github.com/rails/sprockets#sprockets-directives) for details 11 | // about supported directives. 12 | // 13 | //= require jquery 14 | //= require jquery_ujs 15 | //= require twitter/bootstrap 16 | //= require turbolinks 17 | //= require_tree . 18 | -------------------------------------------------------------------------------- /rails5/app/assets/javascripts/bootstrap.js.coffee: -------------------------------------------------------------------------------- 1 | jQuery -> 2 | $("a[rel~=popover], .has-popover").popover() 3 | $("a[rel~=tooltip], .has-tooltip").tooltip() 4 | -------------------------------------------------------------------------------- /rails5/app/assets/stylesheets/application.css: -------------------------------------------------------------------------------- 1 | /* 2 | * This is a manifest file that'll be compiled into application.css, which will include all the files 3 | * listed below. 4 | * 5 | * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets, 6 | * or any plugin's vendor/assets/stylesheets directory can be referenced here using a relative path. 7 | * 8 | * You're free to add application-wide styles to this file and they'll appear at the bottom of the 9 | * compiled file so the styles you add here take precedence over styles defined in any styles 10 | * defined in the other CSS/SCSS files in this directory. It is generally better to create a new 11 | * file per style scope. 12 | * 13 | *= require_tree . 14 | *= require_self 15 | */ 16 | 17 | body { 18 | margin-top: 40px; 19 | } 20 | -------------------------------------------------------------------------------- /rails5/app/assets/stylesheets/bootstrap_and_overrides.css: -------------------------------------------------------------------------------- 1 | /* 2 | * 3 | =require twitter-bootstrap-static/bootstrap 4 | Use Font Awesome icons (default) 5 | To use Glyphicons sprites instead of Font Awesome, replace with "require twitter-bootstrap-static/sprites" 6 | =require twitter-bootstrap-static/fontawesome 7 | */ 8 | -------------------------------------------------------------------------------- /rails5/app/assets/stylesheets/bootstrap_and_overrides.css.less: -------------------------------------------------------------------------------- 1 | // Set correct font paths 2 | @glyphiconsEotPath: font-url("glyphicons-halflings-regular.eot"); 3 | @glyphiconsEotPath_iefix: font-url("glyphicons-halflings-regular.eot?#iefix"); 4 | @glyphiconsWoffPath: font-url("glyphicons-halflings-regular.woff"); 5 | @glyphiconsTtfPath: font-url("glyphicons-halflings-regular.ttf"); 6 | @glyphiconsSvgPath: font-url("glyphicons-halflings-regular.svg#glyphicons_halflingsregular"); 7 | 8 | // Set the Font Awesome (Font Awesome is default. You can disable by commenting below lines) 9 | @fontAwesomeEotPath: font-url("fontawesome-webfont.eot"); 10 | @fontAwesomeEotPath_iefix: font-url("fontawesome-webfont.eot?#iefix"); 11 | @fontAwesomeWoffPath: font-url("fontawesome-webfont.woff"); 12 | @fontAwesomeTtfPath: font-url("fontawesome-webfont.ttf"); 13 | @fontAwesomeSvgPath: font-url("fontawesome-webfont.svg#fontawesomeregular"); 14 | 15 | // Font Awesome 16 | @import "fontawesome/font-awesome"; 17 | 18 | // Glyphicons 19 | //@import "twitter/bootstrap/glyphicons.less"; 20 | 21 | // Your custom LESS stylesheets goes here 22 | // 23 | // Since bootstrap was imported above you have access to its mixins which 24 | // you may use and inherit here 25 | // 26 | // If you'd like to override bootstrap's own variables, you can do so here as well 27 | // See http://twitter.github.com/bootstrap/customize.html#variables for their names and documentation 28 | // 29 | // Example: 30 | // @link-color: #ff0000; 31 | -------------------------------------------------------------------------------- /rails5/app/controllers/application_controller.rb: -------------------------------------------------------------------------------- 1 | class ApplicationController < ActionController::Base 2 | # Prevent CSRF attacks by raising an exception. 3 | # For APIs, you may want to use :null_session instead. 4 | protect_from_forgery with: :exception 5 | end 6 | -------------------------------------------------------------------------------- /rails5/app/controllers/concerns/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/app/controllers/concerns/.keep -------------------------------------------------------------------------------- /rails5/app/controllers/query_controller.rb: -------------------------------------------------------------------------------- 1 | class QueryController < ApplicationController 2 | after_action :reset_database, :except => [:index, :examples] 3 | 4 | def index 5 | @queries = Queries 6 | end 7 | 8 | def examples 9 | @queries = Queries.map do |q| 10 | params[q[:input][:name]] = q[:input][:example] 11 | 12 | result = q.dup 13 | 14 | begin 15 | result[:result] = eval(q[:query]).inspect 16 | rescue => e 17 | result[:result] = e 18 | end 19 | 20 | params[q[:input][:name]] = nil 21 | result[:sql] = last_sql 22 | 23 | reset_database 24 | 25 | result 26 | end 27 | 28 | render :layout => 'examples' 29 | end 30 | 31 | Queries.each do |query| 32 | class_eval <<-RUBY 33 | def #{query[:action]} 34 | begin 35 | show #{query[:query]} 36 | rescue => e 37 | @error = e 38 | @sql = last_sql 39 | render :partial => 'error' 40 | end 41 | end 42 | RUBY 43 | end 44 | 45 | private 46 | 47 | def show query 48 | @sql = last_sql 49 | render :partial => 'result', :locals => { :query => query } 50 | end 51 | 52 | def last_sql 53 | sql = $last_sql 54 | $last_sql = nil 55 | sql 56 | end 57 | 58 | def reset_database 59 | Order.delete_all 60 | User.delete_all 61 | load File.join(Rails.root, 'db/seeds.rb') 62 | end 63 | end 64 | -------------------------------------------------------------------------------- /rails5/app/helpers/application_helper.rb: -------------------------------------------------------------------------------- 1 | require 'coderay' 2 | require 'rdiscount' 3 | 4 | module ApplicationHelper 5 | def ruby_color code 6 | CodeRay.scan(code, :ruby).span.html_safe 7 | end 8 | 9 | def sql_color code 10 | CodeRay.scan(code, :sql).span.html_safe 11 | end 12 | 13 | def md markdown 14 | RDiscount.new(markdown).to_html.html_safe 15 | end 16 | end 17 | -------------------------------------------------------------------------------- /rails5/app/mailers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/app/mailers/.keep -------------------------------------------------------------------------------- /rails5/app/models/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/app/models/.keep -------------------------------------------------------------------------------- /rails5/app/models/concerns/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/app/models/concerns/.keep -------------------------------------------------------------------------------- /rails5/app/models/order.rb: -------------------------------------------------------------------------------- 1 | class Order < ActiveRecord::Base 2 | belongs_to :user 3 | end 4 | -------------------------------------------------------------------------------- /rails5/app/models/user.rb: -------------------------------------------------------------------------------- 1 | class User < ActiveRecord::Base 2 | has_many :orders 3 | end 4 | -------------------------------------------------------------------------------- /rails5/app/views/layouts/application.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails SQL Injection Examples 5 | <%= stylesheet_link_tag "application", :media => "all" %> 6 | <%= javascript_include_tag "application" %> 7 | <%= csrf_meta_tags %> 8 | 21 | 22 | 23 |
24 |
25 |
26 | 27 | 28 | 29 | 30 | 31 | Inject Some SQL 32 |
33 |
    34 |
  • <%= link_to "Clear Results", 'javascript:void(0)', id: "clear" %>
    • 35 |
36 |
37 |
38 |
39 |
40 | 41 |
42 | <%= yield %> 43 |
44 | 45 | 46 | -------------------------------------------------------------------------------- /rails5/app/views/layouts/examples.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails SQL Injection Examples 5 | 6 | <%= stylesheet_link_tag "application", :media => "all" %> 7 | <%= javascript_include_tag "application" %> 8 | <%= csrf_meta_tags %> 9 | 10 | 11 |
12 |
13 |
14 | 15 | 16 | 17 | 18 | 19 | Rails SQL Injection 20 |
21 | 28 | 29 |
    30 | 36 |
37 |
38 |
39 |
40 |
41 | 42 |
43 | <%= yield %> 44 |
45 |
46 |
47 |

More Resources

48 |

49 | This site is brought to you by the folks at Brakeman Pro. 50 |

51 |

52 | More information about Rails security: 53 |

54 | 61 |

62 | This site is also available as a Rails application. To interact with this site dynamically and try out different SQL injection attacks you can clone the code and run it locally. Contributions and corrections are welcome! 63 |

64 |
65 | 66 | 67 | -------------------------------------------------------------------------------- /rails5/app/views/query/_error.html.erb: -------------------------------------------------------------------------------- 1 |
2 | <% if @sql %> 3 |
4 | Query 5 |
6 | <%= @sql %> 7 |
8 |
9 | <% end %> 10 | 11 |
12 | Error 13 |
14 | <%= @error %> 15 |
16 |
17 |
18 | -------------------------------------------------------------------------------- /rails5/app/views/query/_example.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 |

4 | Documentation 5 |

6 |
7 | 8 |

<%= query[:name] || query[:action] %>

9 | 10 |
11 | <%= md query[:desc] if query[:desc] %> 12 |
13 | 14 |

Example

15 |

16 | <%= md query[:example] if query[:example] %> 17 |

18 | 19 |
20 | 
21 | <%= ruby_color "params[:#{query[:input][:name]}] = #{query[:input][:example].inspect}" %>
22 | <%= ruby_color query[:query] %>
23 |
24 | 25 |
26 | Query 27 |
28 | <%= sql_color query[:sql] %> 29 |
30 | Result 31 |
32 | <%= query[:result] %> 33 |
34 |
35 |
36 | -------------------------------------------------------------------------------- /rails5/app/views/query/_query.html.erb: -------------------------------------------------------------------------------- 1 |
2 | <%= form_tag("/query/#{query[:action]}", :remote => true, :update => "#{query[:name]}result") do %> 3 |
4 | <%= query[:name] || query[:action] %> 5 | 6 |
7 | <%= ruby_color query[:query] %> 8 |
9 | 10 | <% if input = query[:input] %> 11 |
12 |
13 | <%= input[:name].capitalize %> 14 | <%= text_field_tag input[:name], input[:example], :class => 'text_field input-xlarge' %> 15 | 16 | <%= submit_tag "Run!", :class => 'btn' %> 17 |
18 |
19 | 20 | <% end %> 21 | <% end %> 22 |
23 | 24 |
25 |
26 | 27 |
28 | -------------------------------------------------------------------------------- /rails5/app/views/query/_result.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 | Query 4 |
5 | <%= sql_color @sql %> 6 |
7 |
8 | 9 |
10 | Result 11 |
12 | <%= query.inspect %> 13 |
14 |
15 | 16 |
17 | Params 18 |
19 | <%= params.inspect %> 20 |
21 |
22 | 23 | 24 |
25 | -------------------------------------------------------------------------------- /rails5/app/views/query/examples.html.erb: -------------------------------------------------------------------------------- 1 |

Overview

2 |

3 | The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. 4 |

5 |

6 | This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not include SQL injection from known CVEs and are not vulnerabilities themselves, only potential misuses of the methods. 7 |

8 |

9 | Please use this list as a guide of what not to do. 10 |

11 |

12 | This list is in no way exhaustive or complete! Please feel free to contribute. 13 |

14 |

Examples

15 |

16 | Each method or option described below is accompanied by an example demonstrating how the ActiveRecord interface could be exploited if used unsafely. These are not necessarily the worst exploits, they represent just a small hint of what could be accomplished if one is not careful. The examples on this page were tested with Rails 5.0.7 and SQLite 3. 17 |

18 |

Interactive Version

19 |

20 | Clone and run this site from the git repo to try out or modify the examples! 21 |

22 | 23 | <% @queries.each do |q| %> 24 | 25 | 28 | 29 | <% end %> 30 |
26 | <%= render :partial => 'example', :locals => { :query => q } %> 27 |
31 | -------------------------------------------------------------------------------- /rails5/app/views/query/index.html.erb: -------------------------------------------------------------------------------- 1 | 2 | <% @queries.each do |q| %> 3 | 4 | 7 | 8 | <% end %> 9 |
5 | <%= render :partial => 'query', :locals => { :query => q } %> 6 |
10 | -------------------------------------------------------------------------------- /rails5/bin/bundle: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__) 3 | load Gem.bin_path('bundler', 'bundle') 4 | -------------------------------------------------------------------------------- /rails5/bin/rails: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | APP_PATH = File.expand_path('../config/application', __dir__) 3 | require_relative '../config/boot' 4 | require 'rails/commands' 5 | -------------------------------------------------------------------------------- /rails5/bin/rake: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | require_relative '../config/boot' 3 | require 'rake' 4 | Rake.application.run 5 | -------------------------------------------------------------------------------- /rails5/bin/setup: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | require 'pathname' 3 | require 'fileutils' 4 | include FileUtils 5 | 6 | # path to your application root. 7 | APP_ROOT = Pathname.new File.expand_path('../../', __FILE__) 8 | 9 | def system!(*args) 10 | system(*args) || abort("\n== Command #{args} failed ==") 11 | end 12 | 13 | chdir APP_ROOT do 14 | # This script is a starting point to setup your application. 15 | # Add necessary setup steps to this file. 16 | 17 | puts '== Installing dependencies ==' 18 | system! 'gem install bundler --conservative' 19 | system('bundle check') || system!('bundle install') 20 | 21 | # puts "\n== Copying sample files ==" 22 | # unless File.exist?('config/database.yml') 23 | # cp 'config/database.yml.sample', 'config/database.yml' 24 | # end 25 | 26 | puts "\n== Preparing database ==" 27 | system! 'bin/rails db:setup' 28 | 29 | puts "\n== Removing old logs and tempfiles ==" 30 | system! 'bin/rails log:clear tmp:clear' 31 | 32 | puts "\n== Restarting application server ==" 33 | system! 'bin/rails restart' 34 | end 35 | -------------------------------------------------------------------------------- /rails5/bin/spring: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | 3 | # This file loads spring without using Bundler, in order to be fast. 4 | # It gets overwritten when you run the `spring binstub` command. 5 | 6 | unless defined?(Spring) 7 | require 'rubygems' 8 | require 'bundler' 9 | 10 | if (match = Bundler.default_lockfile.read.match(/^GEM$.*?^ (?: )*spring \((.*?)\)$.*?^$/m)) 11 | Gem.paths = { 'GEM_PATH' => [Bundler.bundle_path.to_s, *Gem.path].uniq } 12 | gem 'spring', match[1] 13 | require 'spring/binstub' 14 | end 15 | end 16 | -------------------------------------------------------------------------------- /rails5/bin/update: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | require 'pathname' 3 | require 'fileutils' 4 | include FileUtils 5 | 6 | # path to your application root. 7 | APP_ROOT = Pathname.new File.expand_path('../../', __FILE__) 8 | 9 | def system!(*args) 10 | system(*args) || abort("\n== Command #{args} failed ==") 11 | end 12 | 13 | chdir APP_ROOT do 14 | # This script is a way to update your development environment automatically. 15 | # Add necessary update steps to this file. 16 | 17 | puts '== Installing dependencies ==' 18 | system! 'gem install bundler --conservative' 19 | system('bundle check') || system!('bundle install') 20 | 21 | puts "\n== Updating database ==" 22 | system! 'bin/rails db:migrate' 23 | 24 | puts "\n== Removing old logs and tempfiles ==" 25 | system! 'bin/rails log:clear tmp:clear' 26 | 27 | puts "\n== Restarting application server ==" 28 | system! 'bin/rails restart' 29 | end 30 | -------------------------------------------------------------------------------- /rails5/config.ru: -------------------------------------------------------------------------------- 1 | # This file is used by Rack-based servers to start the application. 2 | 3 | require ::File.expand_path('../config/environment', __FILE__) 4 | run Rails.application 5 | -------------------------------------------------------------------------------- /rails5/config/application.rb: -------------------------------------------------------------------------------- 1 | require_relative 'boot' 2 | 3 | require 'rails/all' 4 | 5 | # Require the gems listed in Gemfile, including any gems 6 | # you've limited to :test, :development, or :production. 7 | Bundler.require(*Rails.groups) 8 | 9 | module Rails4 10 | class Application < Rails::Application 11 | # Settings in config/environments/* take precedence over those specified here. 12 | # Application configuration should go into files in config/initializers 13 | # -- all .rb files in that directory are automatically loaded. 14 | end 15 | end 16 | -------------------------------------------------------------------------------- /rails5/config/boot.rb: -------------------------------------------------------------------------------- 1 | ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__) 2 | 3 | require 'bundler/setup' # Set up gems listed in the Gemfile. 4 | -------------------------------------------------------------------------------- /rails5/config/cable.yml: -------------------------------------------------------------------------------- 1 | development: 2 | adapter: async 3 | 4 | test: 5 | adapter: async 6 | 7 | production: 8 | adapter: redis 9 | url: redis://localhost:6379/1 10 | -------------------------------------------------------------------------------- /rails5/config/database.yml: -------------------------------------------------------------------------------- 1 | # SQLite version 3.x 2 | # gem install sqlite3 3 | # 4 | # Ensure the SQLite 3 gem is defined in your Gemfile 5 | # gem 'sqlite3' 6 | # 7 | default: &default 8 | adapter: sqlite3 9 | pool: 5 10 | timeout: 5000 11 | 12 | development: 13 | <<: *default 14 | database: db/development.sqlite3 15 | 16 | # Warning: The database defined as "test" will be erased and 17 | # re-generated from your development database when you run "rake". 18 | # Do not set this db to the same as development or production. 19 | test: 20 | <<: *default 21 | database: db/test.sqlite3 22 | 23 | production: 24 | <<: *default 25 | database: db/production.sqlite3 26 | -------------------------------------------------------------------------------- /rails5/config/environment.rb: -------------------------------------------------------------------------------- 1 | # Load the Rails application. 2 | require_relative 'application' 3 | 4 | # Initialize the Rails application. 5 | Rails.application.initialize! 6 | -------------------------------------------------------------------------------- /rails5/config/environments/development.rb: -------------------------------------------------------------------------------- 1 | Rails.application.configure do 2 | # Settings specified here will take precedence over those in config/application.rb. 3 | 4 | # In the development environment your application's code is reloaded on 5 | # every request. This slows down response time but is perfect for development 6 | # since you don't have to restart the web server when you make code changes. 7 | config.cache_classes = false 8 | 9 | # Do not eager load code on boot. 10 | config.eager_load = false 11 | 12 | # Show full error reports. 13 | config.consider_all_requests_local = true 14 | 15 | # Enable/disable caching. By default caching is disabled. 16 | if Rails.root.join('tmp/caching-dev.txt').exist? 17 | config.action_controller.perform_caching = true 18 | 19 | config.cache_store = :memory_store 20 | config.public_file_server.headers = { 21 | 'Cache-Control' => 'public, max-age=172800' 22 | } 23 | else 24 | config.action_controller.perform_caching = false 25 | 26 | config.cache_store = :null_store 27 | end 28 | 29 | # Don't care if the mailer can't send. 30 | config.action_mailer.raise_delivery_errors = false 31 | 32 | config.action_mailer.perform_caching = false 33 | 34 | # Print deprecation notices to the Rails logger. 35 | config.active_support.deprecation = :log 36 | 37 | # Raise an error on page load if there are pending migrations. 38 | config.active_record.migration_error = :page_load 39 | 40 | # Debug mode disables concatenation and preprocessing of assets. 41 | # This option may cause significant delays in view rendering with a large 42 | # number of complex assets. 43 | config.assets.debug = true 44 | 45 | # Suppress logger output for asset requests. 46 | config.assets.quiet = true 47 | 48 | # Raises error for missing translations 49 | # config.action_view.raise_on_missing_translations = true 50 | 51 | # Use an evented file watcher to asynchronously detect changes in source code, 52 | # routes, locales, etc. This feature depends on the listen gem. 53 | # config.file_watcher = ActiveSupport::EventedFileUpdateChecker 54 | end 55 | -------------------------------------------------------------------------------- /rails5/config/environments/test.rb: -------------------------------------------------------------------------------- 1 | Rails.application.configure do 2 | # Settings specified here will take precedence over those in config/application.rb. 3 | 4 | # The test environment is used exclusively to run your application's 5 | # test suite. You never need to work with it otherwise. Remember that 6 | # your test database is "scratch space" for the test suite and is wiped 7 | # and recreated between test runs. Don't rely on the data there! 8 | config.cache_classes = true 9 | 10 | # Do not eager load code on boot. This avoids loading your whole application 11 | # just for the purpose of running a single test. If you are using a tool that 12 | # preloads Rails for running tests, you may have to set it to true. 13 | config.eager_load = false 14 | 15 | # Configure public file server for tests with Cache-Control for performance. 16 | config.public_file_server.enabled = true 17 | config.public_file_server.headers = { 18 | 'Cache-Control' => 'public, max-age=3600' 19 | } 20 | 21 | # Show full error reports and disable caching. 22 | config.consider_all_requests_local = true 23 | config.action_controller.perform_caching = false 24 | 25 | # Raise exceptions instead of rendering exception templates. 26 | config.action_dispatch.show_exceptions = false 27 | 28 | # Disable request forgery protection in test environment. 29 | config.action_controller.allow_forgery_protection = false 30 | config.action_mailer.perform_caching = false 31 | 32 | # Tell Action Mailer not to deliver emails to the real world. 33 | # The :test delivery method accumulates sent emails in the 34 | # ActionMailer::Base.deliveries array. 35 | config.action_mailer.delivery_method = :test 36 | 37 | # Print deprecation notices to the stderr. 38 | config.active_support.deprecation = :stderr 39 | 40 | # Raises error for missing translations 41 | # config.action_view.raise_on_missing_translations = true 42 | end 43 | -------------------------------------------------------------------------------- /rails5/config/initializers/application_controller_renderer.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # ApplicationController.renderer.defaults.merge!( 4 | # http_host: 'example.org', 5 | # https: false 6 | # ) 7 | -------------------------------------------------------------------------------- /rails5/config/initializers/assets.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Version of your assets, change this if you want to expire all your assets. 4 | Rails.application.config.assets.version = '1.0' 5 | 6 | # Add additional assets to the asset load path 7 | # Rails.application.config.assets.paths << Emoji.images_path 8 | 9 | # Precompile additional assets. 10 | # application.js, application.css, and all non-JS/CSS in app/assets folder are already added. 11 | # Rails.application.config.assets.precompile += %w( search.js ) 12 | -------------------------------------------------------------------------------- /rails5/config/initializers/backtrace_silencers.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces. 4 | # Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ } 5 | 6 | # You can also remove all the silencers if you're trying to debug a problem that might stem from framework code. 7 | # Rails.backtrace_cleaner.remove_silencers! 8 | -------------------------------------------------------------------------------- /rails5/config/initializers/cookies_serializer.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Specify a serializer for the signed and encrypted cookie jars. 4 | # Valid options are :json, :marshal, and :hybrid. 5 | Rails.application.config.action_dispatch.cookies_serializer = :json 6 | -------------------------------------------------------------------------------- /rails5/config/initializers/filter_parameter_logging.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Configure sensitive parameters which will be filtered from the log file. 4 | Rails.application.config.filter_parameters += [:password] 5 | -------------------------------------------------------------------------------- /rails5/config/initializers/inflections.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new inflection rules using the following format. Inflections 4 | # are locale specific, and you may define rules for as many different 5 | # locales as you wish. All of these examples are active by default: 6 | # ActiveSupport::Inflector.inflections(:en) do |inflect| 7 | # inflect.plural /^(ox)$/i, '\1en' 8 | # inflect.singular /^(ox)en/i, '\1' 9 | # inflect.irregular 'person', 'people' 10 | # inflect.uncountable %w( fish sheep ) 11 | # end 12 | 13 | # These inflection rules are supported but not enabled by default: 14 | # ActiveSupport::Inflector.inflections(:en) do |inflect| 15 | # inflect.acronym 'RESTful' 16 | # end 17 | -------------------------------------------------------------------------------- /rails5/config/initializers/logger.rb: -------------------------------------------------------------------------------- 1 | if not defined? ActiveRecord::ConnectionAdapters::AbstractAdapter 2 | abort "Need to be able to override AbstractAdapter log" 3 | end 4 | 5 | class ActiveRecord::ConnectionAdapters::AbstractAdapter 6 | alias oldlog log 7 | 8 | def log sql, *args, &block 9 | $last_sql = sql 10 | oldlog sql, *args, &block 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails5/config/initializers/mime_types.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new mime types for use in respond_to blocks: 4 | # Mime::Type.register "text/richtext", :rtf 5 | -------------------------------------------------------------------------------- /rails5/config/initializers/new_framework_defaults.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | # 3 | # This file contains migration options to ease your Rails 5.0 upgrade. 4 | # 5 | # Once upgraded flip defaults one by one to migrate to the new default. 6 | # 7 | # Read the Rails 5.0 release notes for more info on each option. 8 | 9 | # Enable per-form CSRF tokens. Previous versions had false. 10 | Rails.application.config.action_controller.per_form_csrf_tokens = false 11 | 12 | # Enable origin-checking CSRF mitigation. Previous versions had false. 13 | Rails.application.config.action_controller.forgery_protection_origin_check = false 14 | 15 | # Make Ruby 2.4 preserve the timezone of the receiver when calling `to_time`. 16 | # Previous versions had false. 17 | ActiveSupport.to_time_preserves_timezone = false 18 | 19 | # Require `belongs_to` associations by default. Previous versions had false. 20 | Rails.application.config.active_record.belongs_to_required_by_default = false 21 | 22 | # Do not halt callback chains when a callback returns false. Previous versions had true. 23 | ActiveSupport.halt_callback_chains_on_return_false = true 24 | -------------------------------------------------------------------------------- /rails5/config/initializers/session_store.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | Rails.application.config.session_store :cookie_store, key: '_rails4_session' 4 | -------------------------------------------------------------------------------- /rails5/config/initializers/wrap_parameters.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # This file contains settings for ActionController::ParamsWrapper which 4 | # is enabled by default. 5 | 6 | # Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array. 7 | ActiveSupport.on_load(:action_controller) do 8 | wrap_parameters format: [:json] 9 | end 10 | 11 | # To enable root element in JSON for ActiveRecord objects. 12 | # ActiveSupport.on_load(:active_record) do 13 | # self.include_root_in_json = true 14 | # end 15 | -------------------------------------------------------------------------------- /rails5/config/locales/en.bootstrap.yml: -------------------------------------------------------------------------------- 1 | # Sample localization file for English. Add more files in this directory for other locales. 2 | # See https://github.com/svenfuchs/rails-i18n/tree/master/rails%2Flocale for starting points. 3 | 4 | en: 5 | breadcrumbs: 6 | application: 7 | root: "Index" 8 | pages: 9 | pages: "Pages" 10 | helpers: 11 | actions: "Actions" 12 | links: 13 | back: "Back" 14 | cancel: "Cancel" 15 | confirm: "Are you sure?" 16 | destroy: "Delete" 17 | new: "New" 18 | edit: "Edit" 19 | titles: 20 | edit: "Edit %{model}" 21 | save: "Save %{model}" 22 | new: "New %{model}" 23 | delete: "Delete %{model}" 24 | -------------------------------------------------------------------------------- /rails5/config/locales/en.yml: -------------------------------------------------------------------------------- 1 | # Files in the config/locales directory are used for internationalization 2 | # and are automatically loaded by Rails. If you want to use locales other 3 | # than English, add the necessary files in this directory. 4 | # 5 | # To use the locales, use `I18n.t`: 6 | # 7 | # I18n.t 'hello' 8 | # 9 | # In views, this is aliased to just `t`: 10 | # 11 | # <%= t('hello') %> 12 | # 13 | # To use a different locale, set it with `I18n.locale`: 14 | # 15 | # I18n.locale = :es 16 | # 17 | # This would use the information in config/locales/es.yml. 18 | # 19 | # To learn more, please read the Rails Internationalization guide 20 | # available at http://guides.rubyonrails.org/i18n.html. 21 | 22 | en: 23 | hello: "Hello world" 24 | -------------------------------------------------------------------------------- /rails5/config/puma.rb: -------------------------------------------------------------------------------- 1 | # Puma can serve each request in a thread from an internal thread pool. 2 | # The `threads` method setting takes two numbers a minimum and maximum. 3 | # Any libraries that use thread pools should be configured to match 4 | # the maximum value specified for Puma. Default is set to 5 threads for minimum 5 | # and maximum, this matches the default thread size of Active Record. 6 | # 7 | threads_count = ENV.fetch("RAILS_MAX_THREADS") { 5 }.to_i 8 | threads threads_count, threads_count 9 | 10 | # Specifies the `port` that Puma will listen on to receive requests, default is 3000. 11 | # 12 | port ENV.fetch("PORT") { 3000 } 13 | 14 | # Specifies the `environment` that Puma will run in. 15 | # 16 | environment ENV.fetch("RAILS_ENV") { "development" } 17 | 18 | # Specifies the number of `workers` to boot in clustered mode. 19 | # Workers are forked webserver processes. If using threads and workers together 20 | # the concurrency of the application would be max `threads` * `workers`. 21 | # Workers do not work on JRuby or Windows (both of which do not support 22 | # processes). 23 | # 24 | # workers ENV.fetch("WEB_CONCURRENCY") { 2 } 25 | 26 | # Use the `preload_app!` method when specifying a `workers` number. 27 | # This directive tells Puma to first boot the application and load code 28 | # before forking the application. This takes advantage of Copy On Write 29 | # process behavior so workers use less memory. If you use this option 30 | # you need to make sure to reconnect any threads in the `on_worker_boot` 31 | # block. 32 | # 33 | # preload_app! 34 | 35 | # The code in the `on_worker_boot` will be called if you are using 36 | # clustered mode by specifying a number of `workers`. After each worker 37 | # process is booted this block will be run, if you are using `preload_app!` 38 | # option you will want to use this block to reconnect to any threads 39 | # or connections that may have been created at application boot, Ruby 40 | # cannot share connections between processes. 41 | # 42 | # on_worker_boot do 43 | # ActiveRecord::Base.establish_connection if defined?(ActiveRecord) 44 | # end 45 | 46 | # Allow puma to be restarted by `rails restart` command. 47 | plugin :tmp_restart 48 | -------------------------------------------------------------------------------- /rails5/config/routes.rb: -------------------------------------------------------------------------------- 1 | Rails4::Application.routes.draw do 2 | post 'query/:action', controller: :query 3 | get 'examples', to: 'query#examples' 4 | root 'query#index' 5 | end 6 | -------------------------------------------------------------------------------- /rails5/config/secrets.yml: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Your secret key is used for verifying the integrity of signed cookies. 4 | # If you change this key, all old signed cookies will become invalid! 5 | 6 | # Make sure the secret is at least 30 characters and all random, 7 | # no regular words or you'll be exposed to dictionary attacks. 8 | # You can use `rails secret` to generate a secure secret key. 9 | 10 | # Make sure the secrets in this file are kept private 11 | # if you're sharing your code publicly. 12 | 13 | development: 14 | secret_key_base: 90b330bcd1cf44f0bdf1cfef10f8c99d7ec8dc8757387a009e1412e5b1401716d8d28fe94e3148259c19c38c5759983fb0496f8e25b24b5e16164bc39ed45bf4 15 | 16 | test: 17 | secret_key_base: ec86e52a3c4a15b6c3fd239f8207943f66f4735a387ecfd2ddfef60bb3eb039618d5021434211a694c908e83820c0dc42ac8351986706ee5afbfd1568875cf67 18 | 19 | # Do not keep production secrets in the repository, 20 | # instead read values from the environment. 21 | production: 22 | secret_key_base: secret_hehe 23 | -------------------------------------------------------------------------------- /rails5/config/spring.rb: -------------------------------------------------------------------------------- 1 | %w( 2 | .ruby-version 3 | .rbenv-vars 4 | tmp/restart.txt 5 | tmp/caching-dev.txt 6 | ).each { |path| Spring.watch(path) } 7 | -------------------------------------------------------------------------------- /rails5/db/migrate/20130201060049_create_users.rb: -------------------------------------------------------------------------------- 1 | class CreateUsers < ActiveRecord::Migration 2 | def change 3 | create_table :users do |t| 4 | t.string :name 5 | t.string :password 6 | t.integer :age 7 | t.boolean :admin 8 | 9 | t.timestamps 10 | end 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails5/db/migrate/20130201060409_create_orders.rb: -------------------------------------------------------------------------------- 1 | class CreateOrders < ActiveRecord::Migration 2 | def change 3 | create_table :orders do |t| 4 | t.integer :user_id 5 | t.integer :total 6 | 7 | t.timestamps 8 | end 9 | end 10 | end 11 | -------------------------------------------------------------------------------- /rails5/db/schema.rb: -------------------------------------------------------------------------------- 1 | # This file is auto-generated from the current state of the database. Instead 2 | # of editing this file, please use the migrations feature of Active Record to 3 | # incrementally modify your database, and then regenerate this schema definition. 4 | # 5 | # Note that this schema.rb definition is the authoritative source for your 6 | # database schema. If you need to create the application database on another 7 | # system, you should be using db:schema:load, not running all the migrations 8 | # from scratch. The latter is a flawed and unsustainable approach (the more migrations 9 | # you'll amass, the slower it'll run and the greater likelihood for issues). 10 | # 11 | # It's strongly recommended that you check this file into your version control system. 12 | 13 | ActiveRecord::Schema.define(version: 20130201060409) do 14 | 15 | create_table "orders", force: :cascade do |t| 16 | t.integer "user_id" 17 | t.integer "total" 18 | t.datetime "created_at" 19 | t.datetime "updated_at" 20 | end 21 | 22 | create_table "users", force: :cascade do |t| 23 | t.string "name" 24 | t.string "password" 25 | t.integer "age" 26 | t.boolean "admin" 27 | t.datetime "created_at" 28 | t.datetime "updated_at" 29 | end 30 | 31 | end 32 | -------------------------------------------------------------------------------- /rails5/db/seeds.rb: -------------------------------------------------------------------------------- 1 | # This file should contain all the record creation needed to seed the database with its default values. 2 | # The data can then be loaded with the rake db:seed (or created alongside the db with db:setup). 3 | # 4 | # Examples: 5 | # 6 | # cities = City.create([{ name: 'Chicago' }, { name: 'Copenhagen' }]) 7 | # Mayor.create(name: 'Emanuel', city: cities.first) 8 | 9 | ["Bob", "Jim", "Sarah", "Tina", "Tony"].each do |name| 10 | User.create :name => name, :password => "#{name}pass", :admin => false, :age => (rand(60) + 18) 11 | end 12 | 13 | User.create :name => "Admin", :password => "supersecretpass", :admin => true, :age => (rand(60) + 18) 14 | 15 | Order.create :user_id => 1, :total => 10 16 | Order.create :user_id => 3, :total => 500 17 | Order.create :user_id => 4, :total => 1 18 | -------------------------------------------------------------------------------- /rails5/lib/assets/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/lib/assets/.keep -------------------------------------------------------------------------------- /rails5/lib/tasks/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/lib/tasks/.keep -------------------------------------------------------------------------------- /rails5/log/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/log/.keep -------------------------------------------------------------------------------- /rails5/public/404.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The page you were looking for doesn't exist (404) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

The page you were looking for doesn't exist.

62 |

You may have mistyped the address or the page may have moved.

63 |
64 |

If you are the application owner check the logs for more information.

65 |
66 | 67 | 68 | -------------------------------------------------------------------------------- /rails5/public/422.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The change you wanted was rejected (422) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

The change you wanted was rejected.

62 |

Maybe you tried to change something you didn't have access to.

63 |
64 |

If you are the application owner check the logs for more information.

65 |
66 | 67 | 68 | -------------------------------------------------------------------------------- /rails5/public/500.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | We're sorry, but something went wrong (500) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

We're sorry, but something went wrong.

62 |
63 |

If you are the application owner check the logs for more information.

64 |
65 | 66 | 67 | -------------------------------------------------------------------------------- /rails5/public/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/public/favicon.ico -------------------------------------------------------------------------------- /rails5/public/robots.txt: -------------------------------------------------------------------------------- 1 | # See http://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file 2 | # 3 | # To ban all spiders from the entire site uncomment the next two lines: 4 | # User-agent: * 5 | # Disallow: / 6 | -------------------------------------------------------------------------------- /rails5/test/controllers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/test/controllers/.keep -------------------------------------------------------------------------------- /rails5/test/fixtures/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/test/fixtures/.keep -------------------------------------------------------------------------------- /rails5/test/helpers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/test/helpers/.keep -------------------------------------------------------------------------------- /rails5/test/integration/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/test/integration/.keep -------------------------------------------------------------------------------- /rails5/test/mailers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/test/mailers/.keep -------------------------------------------------------------------------------- /rails5/test/models/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/test/models/.keep -------------------------------------------------------------------------------- /rails5/test/test_helper.rb: -------------------------------------------------------------------------------- 1 | ENV['RAILS_ENV'] ||= 'test' 2 | require File.expand_path('../../config/environment', __FILE__) 3 | require 'rails/test_help' 4 | 5 | class ActiveSupport::TestCase 6 | # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order. 7 | fixtures :all 8 | 9 | # Add more helper methods to be used by all tests here... 10 | end 11 | -------------------------------------------------------------------------------- /rails5/vendor/assets/javascripts/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/vendor/assets/javascripts/.keep -------------------------------------------------------------------------------- /rails5/vendor/assets/stylesheets/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails5/vendor/assets/stylesheets/.keep -------------------------------------------------------------------------------- /rails6/.gitattributes: -------------------------------------------------------------------------------- 1 | # See https://git-scm.com/docs/gitattributes for more about git attribute files. 2 | 3 | # Mark the database schema as having been generated. 4 | db/schema.rb linguist-generated 5 | 6 | 7 | # Mark any vendored files as having been vendored. 8 | vendor/* linguist-vendored 9 | -------------------------------------------------------------------------------- /rails6/.gitignore: -------------------------------------------------------------------------------- 1 | # See https://help.github.com/articles/ignoring-files for more about ignoring files. 2 | # 3 | # If you find yourself ignoring temporary files generated by your text editor 4 | # or operating system, you probably want to add a global ignore instead: 5 | # git config --global core.excludesfile '~/.gitignore_global' 6 | 7 | # Ignore bundler config. 8 | /.bundle 9 | 10 | # Ignore the default SQLite database. 11 | /db/*.sqlite3 12 | /db/*.sqlite3-* 13 | 14 | # Ignore all logfiles and tempfiles. 15 | /log/* 16 | /tmp/* 17 | !/log/.keep 18 | !/tmp/.keep 19 | 20 | # Ignore pidfiles, but keep the directory. 21 | /tmp/pids/* 22 | !/tmp/pids/ 23 | !/tmp/pids/.keep 24 | 25 | 26 | /public/assets 27 | .byebug_history 28 | 29 | # Ignore master key for decrypting credentials and more. 30 | /config/master.key 31 | -------------------------------------------------------------------------------- /rails6/.ruby-version: -------------------------------------------------------------------------------- 1 | ruby-2.5.5 2 | -------------------------------------------------------------------------------- /rails6/Gemfile: -------------------------------------------------------------------------------- 1 | source 'https://rubygems.org' 2 | git_source(:github) { |repo| "https://github.com/#{repo}.git" } 3 | 4 | ruby '~>2.5.5' 5 | 6 | # Bundle edge Rails instead: gem 'rails', github: 'rails/rails', branch: 'main' 7 | gem 'rails', '~> 6.1.4' 8 | # Use sqlite3 as the database for Active Record 9 | gem 'sqlite3', '~> 1.4' 10 | # Use Puma as the app server 11 | gem 'puma', '~> 5.6' 12 | # Use SCSS for stylesheets 13 | gem 'sass-rails', '>= 6' 14 | # Use Active Model has_secure_password 15 | # gem 'bcrypt', '~> 3.1.7' 16 | 17 | gem 'coderay', "~> 1.0.8" 18 | gem 'rdiscount' 19 | gem 'twitter-bootstrap-rails', '~>2.2.8' 20 | gem 'jquery-rails' 21 | 22 | group :development, :test do 23 | # Call 'byebug' anywhere in the code to stop execution and get a debugger console 24 | gem 'byebug', platforms: [:mri, :mingw, :x64_mingw] 25 | end 26 | 27 | group :development do 28 | gem 'listen', '~> 3.3' 29 | end 30 | 31 | # Windows does not include zoneinfo files, so bundle the tzinfo-data gem 32 | gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby] 33 | -------------------------------------------------------------------------------- /rails6/README.md: -------------------------------------------------------------------------------- 1 | # README 2 | 3 | This README would normally document whatever steps are necessary to get the 4 | application up and running. 5 | 6 | Things you may want to cover: 7 | 8 | * Ruby version 9 | 10 | * System dependencies 11 | 12 | * Configuration 13 | 14 | * Database creation 15 | 16 | * Database initialization 17 | 18 | * How to run the test suite 19 | 20 | * Services (job queues, cache servers, search engines, etc.) 21 | 22 | * Deployment instructions 23 | 24 | * ... 25 | -------------------------------------------------------------------------------- /rails6/Rakefile: -------------------------------------------------------------------------------- 1 | # Add your own tasks in files placed in lib/tasks ending in .rake, 2 | # for example lib/tasks/capistrano.rake, and they will automatically be available to Rake. 3 | 4 | require_relative "config/application" 5 | 6 | Rails.application.load_tasks 7 | -------------------------------------------------------------------------------- /rails6/app/assets/config/manifest.js: -------------------------------------------------------------------------------- 1 | //= link_tree ../images 2 | //= link_directory ../stylesheets .css 3 | //= link_directory ../javascripts .js 4 | -------------------------------------------------------------------------------- /rails6/app/assets/images/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/app/assets/images/.keep -------------------------------------------------------------------------------- /rails6/app/assets/javascripts/application.js: -------------------------------------------------------------------------------- 1 | // This is a manifest file that'll be compiled into including all the files listed below. 2 | // Add new JavaScript/Coffee code in separate files in this directory and they'll automatically 3 | // be included in the compiled file accessible from http://example.com/assets/application.js 4 | // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the 5 | // the compiled file. 6 | // 7 | //= require jquery 8 | //= require jquery_ujs 9 | //= require twitter/bootstrap 10 | //= require_tree . 11 | -------------------------------------------------------------------------------- /rails6/app/assets/javascripts/bootstrap.js: -------------------------------------------------------------------------------- 1 | jQuery(function() { 2 | $("a[rel~=popover], .has-popover").popover(); 3 | $("a[rel~=tooltip], .has-tooltip").tooltip(); 4 | }); 5 | -------------------------------------------------------------------------------- /rails6/app/assets/stylesheets/application.css: -------------------------------------------------------------------------------- 1 | /* 2 | * This is a manifest file that'll be compiled into application.css, which will include all the files 3 | * listed below. 4 | * 5 | * Any CSS and SCSS file within this directory, lib/assets/stylesheets, or any plugin's 6 | * vendor/assets/stylesheets directory can be referenced here using a relative path. 7 | * 8 | * You're free to add application-wide styles to this file and they'll appear at the bottom of the 9 | * compiled file so the styles you add here take precedence over styles defined in any other CSS/SCSS 10 | * files in this directory. Styles in this file should be added after the last require_* statement. 11 | * It is generally better to create a new file per style scope. 12 | * 13 | *= require_tree . 14 | *= require_self 15 | */ 16 | 17 | body { 18 | margin-top: 40px; 19 | } 20 | -------------------------------------------------------------------------------- /rails6/app/assets/stylesheets/bootstrap_and_overrides.css: -------------------------------------------------------------------------------- 1 | /* 2 | =require twitter-bootstrap-static/bootstrap 3 | 4 | Use Font Awesome icons (default) 5 | To use Glyphicons sprites instead of Font Awesome, replace with "require twitter-bootstrap-static/sprites" 6 | =require twitter-bootstrap-static/fontawesome 7 | */ -------------------------------------------------------------------------------- /rails6/app/assets/stylesheets/bootstrap_and_overrides.css.less: -------------------------------------------------------------------------------- 1 | @import "twitter/bootstrap/bootstrap"; 2 | @import "twitter/bootstrap/responsive"; 3 | 4 | // Set the correct sprite paths 5 | @iconSpritePath: image-url("twitter/bootstrap/glyphicons-halflings.png"); 6 | @iconWhiteSpritePath: image-url("twitter/bootstrap/glyphicons-halflings-white.png"); 7 | 8 | // Set the Font Awesome (Font Awesome is default. You can disable by commenting below lines) 9 | @fontAwesomeEotPath: asset-url("fontawesome-webfont.eot"); 10 | @fontAwesomeEotPath_iefix: asset-url("fontawesome-webfont.eot?#iefix"); 11 | @fontAwesomeWoffPath: asset-url("fontawesome-webfont.woff"); 12 | @fontAwesomeTtfPath: asset-url("fontawesome-webfont.ttf"); 13 | @fontAwesomeSvgPath: asset-url("fontawesome-webfont.svg#fontawesomeregular"); 14 | 15 | // Font Awesome 16 | @import "fontawesome/font-awesome"; 17 | 18 | // Glyphicons 19 | //@import "twitter/bootstrap/sprites.less"; 20 | 21 | // Your custom LESS stylesheets goes here 22 | // 23 | // Since bootstrap was imported above you have access to its mixins which 24 | // you may use and inherit here 25 | // 26 | // If you'd like to override bootstrap's own variables, you can do so here as well 27 | // See http://twitter.github.com/bootstrap/customize.html#variables for their names and documentation 28 | // 29 | // Example: 30 | // @linkColor: #ff0000; 31 | -------------------------------------------------------------------------------- /rails6/app/controllers/application_controller.rb: -------------------------------------------------------------------------------- 1 | class ApplicationController < ActionController::Base 2 | end 3 | -------------------------------------------------------------------------------- /rails6/app/controllers/concerns/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/app/controllers/concerns/.keep -------------------------------------------------------------------------------- /rails6/app/controllers/query_controller.rb: -------------------------------------------------------------------------------- 1 | class QueryController < ApplicationController 2 | after_action :reset_database, :except => [:index, :examples] 3 | 4 | def index 5 | @queries = Queries 6 | end 7 | 8 | def examples 9 | @queries = Queries.map do |q| 10 | params[q[:input][:name]] = q[:input][:example] 11 | 12 | result = q.dup 13 | 14 | begin 15 | value = eval(q[:query]) 16 | result[:result] = case value 17 | when TrueClass, FalseClass, Numeric, String 18 | value 19 | else 20 | Array(value) 21 | end.inspect 22 | rescue => e 23 | result[:result] = e 24 | end 25 | 26 | params[q[:input][:name]] = nil 27 | result[:sql] = last_sql 28 | 29 | reset_database 30 | 31 | result 32 | end 33 | 34 | render :layout => 'examples' 35 | end 36 | 37 | Queries.each do |query| 38 | class_eval <<-RUBY 39 | def #{query[:action]} 40 | begin 41 | value = #{query[:query]} 42 | result = case value 43 | when TrueClass, FalseClass, Numeric, String 44 | value 45 | else 46 | Array(value) 47 | end.inspect 48 | 49 | show result 50 | rescue => e 51 | @error = e 52 | @sql = last_sql 53 | render :partial => 'error' 54 | end 55 | end 56 | RUBY 57 | end 58 | 59 | private 60 | 61 | def show query 62 | @sql = last_sql 63 | render :partial => 'result', :locals => { :query => query } 64 | end 65 | 66 | def last_sql 67 | sql = $last_sql 68 | $last_sql = nil 69 | sql 70 | end 71 | 72 | def reset_database 73 | Order.delete_all 74 | User.delete_all 75 | load File.join(Rails.root, 'db/seeds.rb') 76 | end 77 | end 78 | -------------------------------------------------------------------------------- /rails6/app/helpers/application_helper.rb: -------------------------------------------------------------------------------- 1 | require 'coderay' 2 | require 'rdiscount' 3 | 4 | module ApplicationHelper 5 | def ruby_color code 6 | CodeRay.scan(code, :ruby).span.html_safe 7 | end 8 | 9 | def sql_color code 10 | CodeRay.scan(code, :sql).span.html_safe 11 | end 12 | 13 | def md markdown 14 | RDiscount.new(markdown).to_html.html_safe 15 | end 16 | end 17 | -------------------------------------------------------------------------------- /rails6/app/javascript/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/app/javascript/.keep -------------------------------------------------------------------------------- /rails6/app/javascript/application.js: -------------------------------------------------------------------------------- 1 | //= require twitter/bootstrap 2 | -------------------------------------------------------------------------------- /rails6/app/models/application_record.rb: -------------------------------------------------------------------------------- 1 | class ApplicationRecord < ActiveRecord::Base 2 | self.abstract_class = true 3 | end 4 | -------------------------------------------------------------------------------- /rails6/app/models/concerns/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/app/models/concerns/.keep -------------------------------------------------------------------------------- /rails6/app/models/order.rb: -------------------------------------------------------------------------------- 1 | class Order < ActiveRecord::Base 2 | belongs_to :user 3 | end 4 | -------------------------------------------------------------------------------- /rails6/app/models/user.rb: -------------------------------------------------------------------------------- 1 | class User < ActiveRecord::Base 2 | has_many :orders 3 | end 4 | -------------------------------------------------------------------------------- /rails6/app/views/layouts/application.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails6 5 | 6 | <%= csrf_meta_tags %> 7 | <%= csp_meta_tag %> 8 | 9 | <%= stylesheet_link_tag 'application', media: 'all' %> 10 | 11 | 12 | 13 | <%= yield %> 14 | 15 | 16 | -------------------------------------------------------------------------------- /rails6/app/views/layouts/examples.html.erb: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | Rails SQL Injection Examples 5 | 6 | <%= stylesheet_link_tag "application", :media => "all" %> 7 | <%= javascript_include_tag "application" %> 8 | <%= csrf_meta_tags %> 9 | 10 | 11 |
12 |
13 |
14 | 15 | 16 | 17 | 18 | 19 | Rails SQL Injection 20 |
21 | 28 | 29 |
    30 | 36 |
37 |
38 |
39 |
40 |
41 | 42 |
43 | <%= yield %> 44 |
45 |
46 |
47 |

More Resources

48 | 55 |

56 | This site is also available as a Rails application. To interact with this site dynamically and try out different SQL injection attacks you can clone the code and run it locally. Contributions and corrections are welcome! 57 |

58 |
59 | 60 | 61 | -------------------------------------------------------------------------------- /rails6/app/views/query/_error.html.erb: -------------------------------------------------------------------------------- 1 |
2 | <% if @sql %> 3 |
4 | Query 5 |
6 | <%= @sql %> 7 |
8 |
9 | <% end %> 10 | 11 |
12 | Error 13 |
14 | <%= @error %> 15 |
16 |
17 |
18 | -------------------------------------------------------------------------------- /rails6/app/views/query/_example.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 |

4 | Documentation 5 |

6 |
7 | 8 |

<%= query[:name] || query[:action] %>

9 | 10 |
11 | <%= md query[:desc] if query[:desc] %> 12 |
13 | 14 |

Example

15 |

16 | <%= md query[:example] if query[:example] %> 17 |

18 | 19 |
20 | 
21 | <%= ruby_color "params[:#{query[:input][:name]}] = #{query[:input][:example].inspect}" %>
22 | <%= ruby_color query[:query] %>
23 |
24 | 25 |
26 | Query 27 |
28 | <%= sql_color query[:sql] %> 29 |
30 | Result 31 |
32 | <%= query[:result] %> 33 |
34 |
35 |
36 | -------------------------------------------------------------------------------- /rails6/app/views/query/_query.html.erb: -------------------------------------------------------------------------------- 1 | <% 2 | query_box_id = query[:name].underscore 3 | query_result_id = "#{query_box_id}_result" 4 | %> 5 | 6 |
7 | <%= form_with(url: "/query/#{query[:action]}", local: false) do |form| %> 8 |
9 | <%= hidden_field_tag :result_field, query_result_id %> 10 | <%= query[:name] || query[:action] %> 11 | 12 |
13 | <%= ruby_color query[:query] %> 14 |
15 | 16 | <% if input = query[:input] %> 17 |
18 |
19 | <%= input[:name].capitalize %> 20 | <%= text_field_tag input[:name], input[:example], :class => 'text_field input-xlarge' %> 21 | 22 | <%= form.submit "Run!", :class => 'btn' %> 23 |
24 |
25 | 26 | <% end %> 27 | <% end %> 28 |
29 | 30 |
31 |
32 | 33 |
34 | -------------------------------------------------------------------------------- /rails6/app/views/query/_result.html.erb: -------------------------------------------------------------------------------- 1 |
2 |
3 | Query 4 |
5 | <%= sql_color @sql %> 6 |
7 |
8 | 9 |
10 | Result 11 |
12 | <%= query.inspect %> 13 |
14 |
15 | 16 |
17 | Params 18 |
19 | <%= params.inspect %> 20 |
21 |
22 | 23 | 24 |
25 | -------------------------------------------------------------------------------- /rails6/app/views/query/examples.html.erb: -------------------------------------------------------------------------------- 1 |

Overview

2 |

3 | The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. 4 |

5 |

6 | This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not include SQL injection from known CVEs and are not vulnerabilities themselves, only potential misuses of the methods. 7 |

8 |

9 | Please use this list as a guide of what not to do. 10 |

11 |

12 | This list is in no way exhaustive or complete! Please feel free to contribute. 13 |

14 |

Examples

15 |

16 | Each method or option described below is accompanied by an example demonstrating how the ActiveRecord interface could be exploited if used unsafely. These are not necessarily the worst exploits, they represent just a small hint of what could be accomplished if one is not careful. The examples on this page were tested with Rails 6.1.4 and SQLite 3. 17 |

18 |

Interactive Version

19 |

20 | Clone and run this site from the git repo to try out or modify the examples! 21 |

22 | 23 | <% @queries.each do |q| %> 24 | 25 | 28 | 29 | <% end %> 30 |
26 | <%= render :partial => 'example', :locals => { :query => q } %> 27 |
31 | -------------------------------------------------------------------------------- /rails6/app/views/query/index.html.erb: -------------------------------------------------------------------------------- 1 | 2 | <% @queries.each do |q| %> 3 | 4 | 7 | 8 | <% end %> 9 |
5 | <%= render :partial => 'query', :locals => { :query => q } %> 6 |
10 | -------------------------------------------------------------------------------- /rails6/app/views/query/query.js.erb: -------------------------------------------------------------------------------- 1 | var result_box = document.find_element_by_id("<%= params[:result_box] %>"); 2 | result_box.html("<%= 'hi' %>"); 3 | -------------------------------------------------------------------------------- /rails6/bin/bundle: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | # frozen_string_literal: true 3 | 4 | # 5 | # This file was generated by Bundler. 6 | # 7 | # The application 'bundle' is installed as part of a gem, and 8 | # this file is here to facilitate running it. 9 | # 10 | 11 | require "rubygems" 12 | 13 | m = Module.new do 14 | module_function 15 | 16 | def invoked_as_script? 17 | File.expand_path($0) == File.expand_path(__FILE__) 18 | end 19 | 20 | def env_var_version 21 | ENV["BUNDLER_VERSION"] 22 | end 23 | 24 | def cli_arg_version 25 | return unless invoked_as_script? # don't want to hijack other binstubs 26 | return unless "update".start_with?(ARGV.first || " ") # must be running `bundle update` 27 | bundler_version = nil 28 | update_index = nil 29 | ARGV.each_with_index do |a, i| 30 | if update_index && update_index.succ == i && a =~ Gem::Version::ANCHORED_VERSION_PATTERN 31 | bundler_version = a 32 | end 33 | next unless a =~ /\A--bundler(?:[= ](#{Gem::Version::VERSION_PATTERN}))?\z/ 34 | bundler_version = $1 35 | update_index = i 36 | end 37 | bundler_version 38 | end 39 | 40 | def gemfile 41 | gemfile = ENV["BUNDLE_GEMFILE"] 42 | return gemfile if gemfile && !gemfile.empty? 43 | 44 | File.expand_path("../../Gemfile", __FILE__) 45 | end 46 | 47 | def lockfile 48 | lockfile = 49 | case File.basename(gemfile) 50 | when "gems.rb" then gemfile.sub(/\.rb$/, gemfile) 51 | else "#{gemfile}.lock" 52 | end 53 | File.expand_path(lockfile) 54 | end 55 | 56 | def lockfile_version 57 | return unless File.file?(lockfile) 58 | lockfile_contents = File.read(lockfile) 59 | return unless lockfile_contents =~ /\n\nBUNDLED WITH\n\s{2,}(#{Gem::Version::VERSION_PATTERN})\n/ 60 | Regexp.last_match(1) 61 | end 62 | 63 | def bundler_version 64 | @bundler_version ||= 65 | env_var_version || cli_arg_version || 66 | lockfile_version 67 | end 68 | 69 | def bundler_requirement 70 | return "#{Gem::Requirement.default}.a" unless bundler_version 71 | 72 | bundler_gem_version = Gem::Version.new(bundler_version) 73 | 74 | requirement = bundler_gem_version.approximate_recommendation 75 | 76 | return requirement unless Gem::Version.new(Gem::VERSION) < Gem::Version.new("2.7.0") 77 | 78 | requirement += ".a" if bundler_gem_version.prerelease? 79 | 80 | requirement 81 | end 82 | 83 | def load_bundler! 84 | ENV["BUNDLE_GEMFILE"] ||= gemfile 85 | 86 | activate_bundler 87 | end 88 | 89 | def activate_bundler 90 | gem_error = activation_error_handling do 91 | gem "bundler", bundler_requirement 92 | end 93 | return if gem_error.nil? 94 | require_error = activation_error_handling do 95 | require "bundler/version" 96 | end 97 | return if require_error.nil? && Gem::Requirement.new(bundler_requirement).satisfied_by?(Gem::Version.new(Bundler::VERSION)) 98 | warn "Activating bundler (#{bundler_requirement}) failed:\n#{gem_error.message}\n\nTo install the version of bundler this project requires, run `gem install bundler -v '#{bundler_requirement}'`" 99 | exit 42 100 | end 101 | 102 | def activation_error_handling 103 | yield 104 | nil 105 | rescue StandardError, LoadError => e 106 | e 107 | end 108 | end 109 | 110 | m.load_bundler! 111 | 112 | if m.invoked_as_script? 113 | load Gem.bin_path("bundler", "bundle") 114 | end 115 | -------------------------------------------------------------------------------- /rails6/bin/rails: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | APP_PATH = File.expand_path('../config/application', __dir__) 3 | require_relative "../config/boot" 4 | require "rails/commands" 5 | -------------------------------------------------------------------------------- /rails6/bin/rake: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | require_relative "../config/boot" 3 | require "rake" 4 | Rake.application.run 5 | -------------------------------------------------------------------------------- /rails6/bin/setup: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env ruby 2 | require "fileutils" 3 | 4 | # path to your application root. 5 | APP_ROOT = File.expand_path('..', __dir__) 6 | 7 | def system!(*args) 8 | system(*args) || abort("\n== Command #{args} failed ==") 9 | end 10 | 11 | FileUtils.chdir APP_ROOT do 12 | # This script is a way to set up or update your development environment automatically. 13 | # This script is idempotent, so that you can run it at any time and get an expectable outcome. 14 | # Add necessary setup steps to this file. 15 | 16 | puts '== Installing dependencies ==' 17 | system! 'gem install bundler --conservative' 18 | system('bundle check') || system!('bundle install') 19 | 20 | # puts "\n== Copying sample files ==" 21 | # unless File.exist?('config/database.yml') 22 | # FileUtils.cp 'config/database.yml.sample', 'config/database.yml' 23 | # end 24 | 25 | puts "\n== Preparing database ==" 26 | system! 'bin/rails db:prepare' 27 | 28 | puts "\n== Removing old logs and tempfiles ==" 29 | system! 'bin/rails log:clear tmp:clear' 30 | 31 | puts "\n== Restarting application server ==" 32 | system! 'bin/rails restart' 33 | end 34 | -------------------------------------------------------------------------------- /rails6/config.ru: -------------------------------------------------------------------------------- 1 | # This file is used by Rack-based servers to start the application. 2 | 3 | require_relative "config/environment" 4 | 5 | run Rails.application 6 | Rails.application.load_server 7 | -------------------------------------------------------------------------------- /rails6/config/application.rb: -------------------------------------------------------------------------------- 1 | require_relative "boot" 2 | 3 | require "rails" 4 | # Pick the frameworks you want: 5 | require "active_model/railtie" 6 | # require "active_job/railtie" 7 | require "active_record/railtie" 8 | # require "active_storage/engine" 9 | require "action_controller/railtie" 10 | # require "action_mailer/railtie" 11 | # require "action_mailbox/engine" 12 | # require "action_text/engine" 13 | require "action_view/railtie" 14 | # require "action_cable/engine" 15 | require "sprockets/railtie" 16 | require "rails/test_unit/railtie" 17 | 18 | # Require the gems listed in Gemfile, including any gems 19 | # you've limited to :test, :development, or :production. 20 | Bundler.require(*Rails.groups) 21 | 22 | module Rails6 23 | class Application < Rails::Application 24 | # Initialize configuration defaults for originally generated Rails version. 25 | config.load_defaults 6.1 26 | 27 | # Configuration for the application, engines, and railties goes here. 28 | # 29 | # These settings can be overridden in specific environments using the files 30 | # in config/environments, which are processed later. 31 | # 32 | # config.time_zone = "Central Time (US & Canada)" 33 | # config.eager_load_paths << Rails.root.join("extras") 34 | 35 | # Don't generate system test files. 36 | config.generators.system_tests = nil 37 | end 38 | end 39 | -------------------------------------------------------------------------------- /rails6/config/boot.rb: -------------------------------------------------------------------------------- 1 | ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__) 2 | 3 | require "bundler/setup" # Set up gems listed in the Gemfile. 4 | -------------------------------------------------------------------------------- /rails6/config/credentials.yml.enc: -------------------------------------------------------------------------------- 1 | pFIZKOG/0FxAOg9ASCe2cG/7ObGpyEP6xLdCYKzP738pfsBjM64bHkivkE9jKgIcpDHo7oDAVWlxxLlQhb2yDiRUhyr1rV57/yvRWrEarswLc5Hv6XUBU/xH7OD5G6QbqdbxAuCjNI5LCzntSLVnQBZm6qM0ZJoqGWL5vDjuvVaI0ILjmQ417TXwkRO3lU64P3rbJ2GUdT8cIm1Bpyb3TvpLrCwY4FgNvk2pvrUT/67dQpeSEBI7m4NNQriZ8CHOscJ564r8juQ2gUMOSd+cVOvwSDZVSR/khJmCIpaiLbj3VsF8GZpkQk17y+NZNaCVrodh1EtL9Gl6P0MQDdadTvQIsLK+H8qs/WZCuaVXs9eWE0sKdutPyo+1ZyjjaLkacrqqFZOipcrxGimdVjn7uj4Gj/B57RI7nPfV--uMeU9Sph18HzWogZ--t/ZGnaCkGz0IbkWP4bpqlQ== -------------------------------------------------------------------------------- /rails6/config/database.yml: -------------------------------------------------------------------------------- 1 | # SQLite. Versions 3.8.0 and up are supported. 2 | # gem install sqlite3 3 | # 4 | # Ensure the SQLite 3 gem is defined in your Gemfile 5 | # gem 'sqlite3' 6 | # 7 | default: &default 8 | adapter: sqlite3 9 | pool: <%= ENV.fetch("RAILS_MAX_THREADS") { 5 } %> 10 | timeout: 5000 11 | 12 | development: 13 | <<: *default 14 | database: db/development.sqlite3 15 | 16 | # Warning: The database defined as "test" will be erased and 17 | # re-generated from your development database when you run "rake". 18 | # Do not set this db to the same as development or production. 19 | test: 20 | <<: *default 21 | database: db/test.sqlite3 22 | 23 | production: 24 | <<: *default 25 | database: db/production.sqlite3 26 | -------------------------------------------------------------------------------- /rails6/config/environment.rb: -------------------------------------------------------------------------------- 1 | # Load the Rails application. 2 | require_relative "application" 3 | 4 | # Initialize the Rails application. 5 | Rails.application.initialize! 6 | -------------------------------------------------------------------------------- /rails6/config/environments/development.rb: -------------------------------------------------------------------------------- 1 | require "active_support/core_ext/integer/time" 2 | 3 | Rails.application.configure do 4 | # Settings specified here will take precedence over those in config/application.rb. 5 | 6 | # In the development environment your application's code is reloaded any time 7 | # it changes. This slows down response time but is perfect for development 8 | # since you don't have to restart the web server when you make code changes. 9 | config.cache_classes = false 10 | 11 | # Do not eager load code on boot. 12 | config.eager_load = false 13 | 14 | # Show full error reports. 15 | config.consider_all_requests_local = true 16 | 17 | # Enable/disable caching. By default caching is disabled. 18 | # Run rails dev:cache to toggle caching. 19 | if Rails.root.join('tmp', 'caching-dev.txt').exist? 20 | config.action_controller.perform_caching = true 21 | config.action_controller.enable_fragment_cache_logging = true 22 | 23 | config.cache_store = :memory_store 24 | config.public_file_server.headers = { 25 | 'Cache-Control' => "public, max-age=#{2.days.to_i}" 26 | } 27 | else 28 | config.action_controller.perform_caching = false 29 | 30 | config.cache_store = :null_store 31 | end 32 | 33 | # Print deprecation notices to the Rails logger. 34 | config.active_support.deprecation = :log 35 | 36 | # Raise exceptions for disallowed deprecations. 37 | config.active_support.disallowed_deprecation = :raise 38 | 39 | # Tell Active Support which deprecation messages to disallow. 40 | config.active_support.disallowed_deprecation_warnings = [] 41 | 42 | # Raise an error on page load if there are pending migrations. 43 | config.active_record.migration_error = :page_load 44 | 45 | # Highlight code that triggered database queries in logs. 46 | config.active_record.verbose_query_logs = true 47 | 48 | # Debug mode disables concatenation and preprocessing of assets. 49 | # This option may cause significant delays in view rendering with a large 50 | # number of complex assets. 51 | config.assets.debug = true 52 | 53 | # Suppress logger output for asset requests. 54 | config.assets.quiet = true 55 | 56 | # Raises error for missing translations. 57 | # config.i18n.raise_on_missing_translations = true 58 | 59 | # Annotate rendered view with file names. 60 | # config.action_view.annotate_rendered_view_with_filenames = true 61 | 62 | # Use an evented file watcher to asynchronously detect changes in source code, 63 | # routes, locales, etc. This feature depends on the listen gem. 64 | config.file_watcher = ActiveSupport::EventedFileUpdateChecker 65 | 66 | # Uncomment if you wish to allow Action Cable access from any origin. 67 | # config.action_cable.disable_request_forgery_protection = true 68 | end 69 | -------------------------------------------------------------------------------- /rails6/config/environments/test.rb: -------------------------------------------------------------------------------- 1 | require "active_support/core_ext/integer/time" 2 | 3 | # The test environment is used exclusively to run your application's 4 | # test suite. You never need to work with it otherwise. Remember that 5 | # your test database is "scratch space" for the test suite and is wiped 6 | # and recreated between test runs. Don't rely on the data there! 7 | 8 | Rails.application.configure do 9 | # Settings specified here will take precedence over those in config/application.rb. 10 | 11 | config.cache_classes = true 12 | 13 | # Do not eager load code on boot. This avoids loading your whole application 14 | # just for the purpose of running a single test. If you are using a tool that 15 | # preloads Rails for running tests, you may have to set it to true. 16 | config.eager_load = false 17 | 18 | # Configure public file server for tests with Cache-Control for performance. 19 | config.public_file_server.enabled = true 20 | config.public_file_server.headers = { 21 | 'Cache-Control' => "public, max-age=#{1.hour.to_i}" 22 | } 23 | 24 | # Show full error reports and disable caching. 25 | config.consider_all_requests_local = true 26 | config.action_controller.perform_caching = false 27 | config.cache_store = :null_store 28 | 29 | # Raise exceptions instead of rendering exception templates. 30 | config.action_dispatch.show_exceptions = false 31 | 32 | # Disable request forgery protection in test environment. 33 | config.action_controller.allow_forgery_protection = false 34 | 35 | # Print deprecation notices to the stderr. 36 | config.active_support.deprecation = :stderr 37 | 38 | # Raise exceptions for disallowed deprecations. 39 | config.active_support.disallowed_deprecation = :raise 40 | 41 | # Tell Active Support which deprecation messages to disallow. 42 | config.active_support.disallowed_deprecation_warnings = [] 43 | 44 | # Raises error for missing translations. 45 | # config.i18n.raise_on_missing_translations = true 46 | 47 | # Annotate rendered view with file names. 48 | # config.action_view.annotate_rendered_view_with_filenames = true 49 | end 50 | -------------------------------------------------------------------------------- /rails6/config/initializers/application_controller_renderer.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # ActiveSupport::Reloader.to_prepare do 4 | # ApplicationController.renderer.defaults.merge!( 5 | # http_host: 'example.org', 6 | # https: false 7 | # ) 8 | # end 9 | -------------------------------------------------------------------------------- /rails6/config/initializers/assets.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Version of your assets, change this if you want to expire all your assets. 4 | Rails.application.config.assets.version = '1.0' 5 | 6 | # Add additional assets to the asset load path. 7 | # Rails.application.config.assets.paths << Emoji.images_path 8 | 9 | # Precompile additional assets. 10 | # application.js, application.css, and all non-JS/CSS in the app/assets 11 | # folder are already added. 12 | # Rails.application.config.assets.precompile += %w( admin.js admin.css ) 13 | -------------------------------------------------------------------------------- /rails6/config/initializers/backtrace_silencers.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces. 4 | # Rails.backtrace_cleaner.add_silencer { |line| /my_noisy_library/.match?(line) } 5 | 6 | # You can also remove all the silencers if you're trying to debug a problem that might stem from framework code 7 | # by setting BACKTRACE=1 before calling your invocation, like "BACKTRACE=1 ./bin/rails runner 'MyClass.perform'". 8 | Rails.backtrace_cleaner.remove_silencers! if ENV["BACKTRACE"] 9 | -------------------------------------------------------------------------------- /rails6/config/initializers/content_security_policy.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Define an application-wide content security policy 4 | # For further information see the following documentation 5 | # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy 6 | 7 | # Rails.application.config.content_security_policy do |policy| 8 | # policy.default_src :self, :https 9 | # policy.font_src :self, :https, :data 10 | # policy.img_src :self, :https, :data 11 | # policy.object_src :none 12 | # policy.script_src :self, :https 13 | # policy.style_src :self, :https 14 | 15 | # # Specify URI for violation reports 16 | # # policy.report_uri "/csp-violation-report-endpoint" 17 | # end 18 | 19 | # If you are using UJS then enable automatic nonce generation 20 | # Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) } 21 | 22 | # Set the nonce only to specific directives 23 | # Rails.application.config.content_security_policy_nonce_directives = %w(script-src) 24 | 25 | # Report CSP violations to a specified URI 26 | # For further information see the following documentation: 27 | # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only 28 | # Rails.application.config.content_security_policy_report_only = true 29 | -------------------------------------------------------------------------------- /rails6/config/initializers/cookies_serializer.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Specify a serializer for the signed and encrypted cookie jars. 4 | # Valid options are :json, :marshal, and :hybrid. 5 | Rails.application.config.action_dispatch.cookies_serializer = :json 6 | -------------------------------------------------------------------------------- /rails6/config/initializers/filter_parameter_logging.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Configure sensitive parameters which will be filtered from the log file. 4 | Rails.application.config.filter_parameters += [ 5 | :passw, :secret, :token, :_key, :crypt, :salt, :certificate, :otp, :ssn 6 | ] 7 | -------------------------------------------------------------------------------- /rails6/config/initializers/inflections.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new inflection rules using the following format. Inflections 4 | # are locale specific, and you may define rules for as many different 5 | # locales as you wish. All of these examples are active by default: 6 | # ActiveSupport::Inflector.inflections(:en) do |inflect| 7 | # inflect.plural /^(ox)$/i, '\1en' 8 | # inflect.singular /^(ox)en/i, '\1' 9 | # inflect.irregular 'person', 'people' 10 | # inflect.uncountable %w( fish sheep ) 11 | # end 12 | 13 | # These inflection rules are supported but not enabled by default: 14 | # ActiveSupport::Inflector.inflections(:en) do |inflect| 15 | # inflect.acronym 'RESTful' 16 | # end 17 | -------------------------------------------------------------------------------- /rails6/config/initializers/logger.rb: -------------------------------------------------------------------------------- 1 | if not defined? ActiveRecord::ConnectionAdapters::AbstractAdapter 2 | abort "Need to be able to override AbstractAdapter log" 3 | end 4 | 5 | class ActiveRecord::ConnectionAdapters::AbstractAdapter 6 | alias oldlog log 7 | 8 | def log sql, *args, &block 9 | $last_sql = sql unless sql.include? 'transaction' 10 | oldlog sql, *args, &block 11 | end 12 | end 13 | -------------------------------------------------------------------------------- /rails6/config/initializers/mime_types.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # Add new mime types for use in respond_to blocks: 4 | # Mime::Type.register "text/richtext", :rtf 5 | -------------------------------------------------------------------------------- /rails6/config/initializers/permissions_policy.rb: -------------------------------------------------------------------------------- 1 | # Define an application-wide HTTP permissions policy. For further 2 | # information see https://developers.google.com/web/updates/2018/06/feature-policy 3 | # 4 | # Rails.application.config.permissions_policy do |f| 5 | # f.camera :none 6 | # f.gyroscope :none 7 | # f.microphone :none 8 | # f.usb :none 9 | # f.fullscreen :self 10 | # f.payment :self, "https://secure.example.com" 11 | # end 12 | -------------------------------------------------------------------------------- /rails6/config/initializers/wrap_parameters.rb: -------------------------------------------------------------------------------- 1 | # Be sure to restart your server when you modify this file. 2 | 3 | # This file contains settings for ActionController::ParamsWrapper which 4 | # is enabled by default. 5 | 6 | # Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array. 7 | ActiveSupport.on_load(:action_controller) do 8 | wrap_parameters format: [:json] 9 | end 10 | 11 | # To enable root element in JSON for ActiveRecord objects. 12 | # ActiveSupport.on_load(:active_record) do 13 | # self.include_root_in_json = true 14 | # end 15 | -------------------------------------------------------------------------------- /rails6/config/locales/en.bootstrap.yml: -------------------------------------------------------------------------------- 1 | # Sample localization file for English. Add more files in this directory for other locales. 2 | # See https://github.com/svenfuchs/rails-i18n/tree/master/rails%2Flocale for starting points. 3 | 4 | en: 5 | helpers: 6 | actions: "Actions" 7 | links: 8 | back: "Back" 9 | cancel: "Cancel" 10 | confirm: "Are you sure?" 11 | destroy: "Delete" 12 | new: "New" 13 | edit: "Edit" 14 | titles: 15 | edit: "Edit %{model}" 16 | save: "Save %{model}" 17 | new: "New %{model}" 18 | delete: "Delete %{model}" 19 | -------------------------------------------------------------------------------- /rails6/config/locales/en.yml: -------------------------------------------------------------------------------- 1 | # Files in the config/locales directory are used for internationalization 2 | # and are automatically loaded by Rails. If you want to use locales other 3 | # than English, add the necessary files in this directory. 4 | # 5 | # To use the locales, use `I18n.t`: 6 | # 7 | # I18n.t 'hello' 8 | # 9 | # In views, this is aliased to just `t`: 10 | # 11 | # <%= t('hello') %> 12 | # 13 | # To use a different locale, set it with `I18n.locale`: 14 | # 15 | # I18n.locale = :es 16 | # 17 | # This would use the information in config/locales/es.yml. 18 | # 19 | # The following keys must be escaped otherwise they will not be retrieved by 20 | # the default I18n backend: 21 | # 22 | # true, false, on, off, yes, no 23 | # 24 | # Instead, surround them with single quotes. 25 | # 26 | # en: 27 | # 'true': 'foo' 28 | # 29 | # To learn more, please read the Rails Internationalization guide 30 | # available at https://guides.rubyonrails.org/i18n.html. 31 | 32 | en: 33 | hello: "Hello world" 34 | -------------------------------------------------------------------------------- /rails6/config/master.key: -------------------------------------------------------------------------------- 1 | fa7ae80e9d511684a3b5c1db39377fe9 -------------------------------------------------------------------------------- /rails6/config/puma.rb: -------------------------------------------------------------------------------- 1 | # Puma can serve each request in a thread from an internal thread pool. 2 | # The `threads` method setting takes two numbers: a minimum and maximum. 3 | # Any libraries that use thread pools should be configured to match 4 | # the maximum value specified for Puma. Default is set to 5 threads for minimum 5 | # and maximum; this matches the default thread size of Active Record. 6 | # 7 | max_threads_count = ENV.fetch("RAILS_MAX_THREADS") { 5 } 8 | min_threads_count = ENV.fetch("RAILS_MIN_THREADS") { max_threads_count } 9 | threads min_threads_count, max_threads_count 10 | 11 | # Specifies the `worker_timeout` threshold that Puma will use to wait before 12 | # terminating a worker in development environments. 13 | # 14 | worker_timeout 3600 if ENV.fetch("RAILS_ENV", "development") == "development" 15 | 16 | # Specifies the `port` that Puma will listen on to receive requests; default is 3000. 17 | # 18 | port ENV.fetch("PORT") { 3000 } 19 | 20 | # Specifies the `environment` that Puma will run in. 21 | # 22 | environment ENV.fetch("RAILS_ENV") { "development" } 23 | 24 | # Specifies the `pidfile` that Puma will use. 25 | pidfile ENV.fetch("PIDFILE") { "tmp/pids/server.pid" } 26 | 27 | # Specifies the number of `workers` to boot in clustered mode. 28 | # Workers are forked web server processes. If using threads and workers together 29 | # the concurrency of the application would be max `threads` * `workers`. 30 | # Workers do not work on JRuby or Windows (both of which do not support 31 | # processes). 32 | # 33 | # workers ENV.fetch("WEB_CONCURRENCY") { 2 } 34 | 35 | # Use the `preload_app!` method when specifying a `workers` number. 36 | # This directive tells Puma to first boot the application and load code 37 | # before forking the application. This takes advantage of Copy On Write 38 | # process behavior so workers use less memory. 39 | # 40 | # preload_app! 41 | 42 | # Allow puma to be restarted by `rails restart` command. 43 | plugin :tmp_restart 44 | -------------------------------------------------------------------------------- /rails6/config/routes.rb: -------------------------------------------------------------------------------- 1 | Rails.application.routes.draw do 2 | post 'query/:action', controller: :query 3 | 4 | get 'examples', to: 'query#examples' 5 | 6 | root 'query#index' 7 | end 8 | -------------------------------------------------------------------------------- /rails6/db/schema.rb: -------------------------------------------------------------------------------- 1 | # This file is auto-generated from the current state of the database. Instead 2 | # of editing this file, please use the migrations feature of Active Record to 3 | # incrementally modify your database, and then regenerate this schema definition. 4 | # 5 | # Note that this schema.rb definition is the authoritative source for your 6 | # database schema. If you need to create the application database on another 7 | # system, you should be using db:schema:load, not running all the migrations 8 | # from scratch. The latter is a flawed and unsustainable approach (the more migrations 9 | # you'll amass, the slower it'll run and the greater likelihood for issues). 10 | # 11 | # It's strongly recommended that you check this file into your version control system. 12 | 13 | ActiveRecord::Schema.define(version: 20130201060409) do 14 | 15 | create_table "orders", force: :cascade do |t| 16 | t.integer "user_id" 17 | t.integer "total" 18 | t.datetime "created_at" 19 | t.datetime "updated_at" 20 | end 21 | 22 | create_table "users", force: :cascade do |t| 23 | t.string "name" 24 | t.string "password" 25 | t.integer "age" 26 | t.boolean "admin" 27 | t.datetime "created_at" 28 | t.datetime "updated_at" 29 | end 30 | 31 | end 32 | -------------------------------------------------------------------------------- /rails6/db/seeds.rb: -------------------------------------------------------------------------------- 1 | # This file should contain all the record creation needed to seed the database with its default values. 2 | # The data can then be loaded with the rake db:seed (or created alongside the db with db:setup). 3 | # 4 | # Examples: 5 | # 6 | # cities = City.create([{ name: 'Chicago' }, { name: 'Copenhagen' }]) 7 | # Mayor.create(name: 'Emanuel', city: cities.first) 8 | 9 | ["Bob", "Jim", "Sarah", "Tina", "Tony"].each do |name| 10 | User.create :name => name, :password => "#{name}pass", :admin => false, :age => (rand(60) + 18) 11 | end 12 | 13 | User.create :name => "Admin", :password => "supersecretpass", :admin => true, :age => (rand(60) + 18) 14 | 15 | first_user_id = User.first.id 16 | 17 | Order.create :user_id => first_user_id, :total => 10 18 | Order.create :user_id => (first_user_id + 1), :total => 500 19 | Order.create :user_id => (first_user_id + 3), :total => 1 20 | -------------------------------------------------------------------------------- /rails6/lib/assets/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/lib/assets/.keep -------------------------------------------------------------------------------- /rails6/lib/tasks/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/lib/tasks/.keep -------------------------------------------------------------------------------- /rails6/log/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/log/.keep -------------------------------------------------------------------------------- /rails6/public/404.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The page you were looking for doesn't exist (404) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

The page you were looking for doesn't exist.

62 |

You may have mistyped the address or the page may have moved.

63 |
64 |

If you are the application owner check the logs for more information.

65 |
66 | 67 | 68 | -------------------------------------------------------------------------------- /rails6/public/422.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | The change you wanted was rejected (422) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

The change you wanted was rejected.

62 |

Maybe you tried to change something you didn't have access to.

63 |
64 |

If you are the application owner check the logs for more information.

65 |
66 | 67 | 68 | -------------------------------------------------------------------------------- /rails6/public/500.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | We're sorry, but something went wrong (500) 5 | 6 | 55 | 56 | 57 | 58 | 59 |
60 |
61 |

We're sorry, but something went wrong.

62 |
63 |

If you are the application owner check the logs for more information.

64 |
65 | 66 | 67 | -------------------------------------------------------------------------------- /rails6/public/apple-touch-icon-precomposed.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/public/apple-touch-icon-precomposed.png -------------------------------------------------------------------------------- /rails6/public/apple-touch-icon.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/public/apple-touch-icon.png -------------------------------------------------------------------------------- /rails6/public/favicon.ico: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/public/favicon.ico -------------------------------------------------------------------------------- /rails6/public/robots.txt: -------------------------------------------------------------------------------- 1 | # See https://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file 2 | -------------------------------------------------------------------------------- /rails6/test/controllers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/test/controllers/.keep -------------------------------------------------------------------------------- /rails6/test/fixtures/files/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/test/fixtures/files/.keep -------------------------------------------------------------------------------- /rails6/test/helpers/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/test/helpers/.keep -------------------------------------------------------------------------------- /rails6/test/integration/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/test/integration/.keep -------------------------------------------------------------------------------- /rails6/test/models/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/test/models/.keep -------------------------------------------------------------------------------- /rails6/test/test_helper.rb: -------------------------------------------------------------------------------- 1 | ENV['RAILS_ENV'] ||= 'test' 2 | require_relative "../config/environment" 3 | require "rails/test_help" 4 | 5 | class ActiveSupport::TestCase 6 | # Run tests in parallel with specified workers 7 | parallelize(workers: :number_of_processors) 8 | 9 | # Setup all fixtures in test/fixtures/*.yml for all tests in alphabetical order. 10 | fixtures :all 11 | 12 | # Add more helper methods to be used by all tests here... 13 | end 14 | -------------------------------------------------------------------------------- /rails6/vendor/.keep: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/presidentbeef/inject-some-sql/f20166437cb27fbe765f463038a5bda9af0534cb/rails6/vendor/.keep --------------------------------------------------------------------------------