SQL Injection in Query

This submodule of the SQL module checks for SQL injection vulnerabilities through usage of the Ecto.Adapters.SQL.query and Ecto.Adapters.SQL.query!.

Ensure that the query is parameterized and not user-controlled.

Calls are matched when they are qualified — Repo.query(sql) or Ecto.Adapters.SQL.query(Repo, sql, []). A bare query(...) is only treated as Ecto's in a file that has import Ecto.Adapters.SQL or use Ecto.Repo, since otherwise the name almost always belongs to a function of the project's own.

SQLi Query checks can be ignored with the following command:

$ mix sobelow -i SQL.Query