rails-security

Rails Security Conventions

Opinionated security conventions for Rails applications. Covers the most critical OWASP risks and Rails-specific pitfalls. For a full audit checklist with grep patterns, see AUDIT.md.

---

Part 1: Input Handling & Injection

SQL Injection — Always parameterize

Never interpolate or concatenate user input into SQL. ActiveRecord's hash and placeholder syntax handles this automatically.

UNSAFE:

User.where("name = '#{params[:name]}'")
User.order("#{params[:sort]} #{params[:direction]}")
ActiveRecord::Base.connection.execute("UPDATE users SET name = '#{name}'")

SAFE:

User.where(name: params[:name])
User.where("name = ?", params[:name])
ActiveRecord::Base.connection.exec_query("UPDATE users SET name = $1", "SQL", [name])

For order/group, allowlist the column before use:

ALLOWED_SORT_COLUMNS = %w[name created_at updated_at].freeze

scope :sorted_by, ->(col) {
  order(ALLOWED_SORT_COLUMNS.include?(col) ? col : :created_at)
}

XSS — Rails escapes by default; do not bypass it

ERB auto-escapes <%= %>. Never call .html_safe or raw() on user-supplied or database content.

UNSAFE:

<%= params[:query].html_safe %>
<%= raw(@user.bio) %>
<%= @card.description.to_s.html_safe %>
<script>var data = <%= @data.to_json %>;</script>

SAFE:

<%= params[:query] %>
<%= sanitize(@user.bio) %>
<%= @card.description %>
<script>var data = <%= json_escape(@data.to_json) %>;</script>

Validate URL protocols before rendering user-supplied links:

<%= link_to "Website", @user.website_url if @user.website_url&.match?(%r{\Ahttps?://}) %>

Use \A / \z in regex validations — not ^ / $ (line vs. string boundaries):

validates :slug, format: { with: /\A[a-z0-9-]+\z/ }  # SAFE
validates :slug, format: { with: /^[a-z0-9-]+$/ }    # UNSAFE — allows newline injection

Command Injection — Use array form for shell calls

# UNSAFE — single string passes through the shell
system("convert #{params[:file]} output.png")

# SAFE — array form bypasses shell interpretation
system("convert", uploaded_file.path, "output.png")
stdout, _s = Open3.capture2("grep", "-r", query, "/data")

# If a shell string is unavoidable, escape the argument
system("tar -czf archive.tar.gz #{Shellwords.escape(directory)}")