class

Flaw::SqlStringBuild

Inherits Flaw::AstRule < Flaw::Rule < Reference < Object

FLAW003 — AST-backed. Fires when a db.query / db.exec / db.scalar / db.query_one / db.query_all call receives a first argument that is a Crystal::StringInterpolation whose literal parts contain SQL keywords, OR a Crystal::Call with name + (string concat) producing the same. Parameterised calls (db.query("... WHERE id = ?", id)) don't fire because their first arg is a StringLiteral.

Constants

DB_CALLS = {"query", "exec", "scalar", "query_one", "query_all", "query_one?"}
SQL_KEYWORD = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|WHERE|FROM|INTO)\b/i

Instance methods

default_severity
Source
description
Source
title
Source
visit(node, source : String, path : String, findings : Array(Finding)) : Nil
Source