Graham McIntie
1590f78bdc
- LIKE wildcard injection: sanitize %, _ in search queries (devices, sites, gaiia) - Jason.decode! → Jason.decode with error handling for untrusted input - inspect() leak: replace with generic error messages, log details server-side - SSRF protection: URL validator blocks private IPs, localhost, non-HTTP schemes - SSRF validation added to HTTP monitoring executor and integration credentials - GraphQL complexity limits: always applied, not just in prod - GraphQL introspection: also check GET query params, not just body - Stripe webhook: explicit nil/empty checks for signature and body - Cookie security: secure flag for session (prod), http_only+secure for remember_me - Honeybadger API key: read from env var with fallback - String.to_integer → Integer.parse with fallback for URL params - String.to_atom → whitelist map for HTTP methods - Gaiia webhook: remove secret_len and expected signature from log - Admin API: add rate limiting pipeline - to_atom_keys: per-key fallback instead of all-or-nothing rescue
17 lines
429 B
Elixir
17 lines
429 B
Elixir
defmodule Towerops.QueryHelpers do
|
|
@moduledoc """
|
|
Shared helpers for building safe Ecto queries.
|
|
"""
|
|
|
|
@doc """
|
|
Sanitizes a string for use in LIKE/ILIKE queries by escaping
|
|
the wildcard characters `%` and `_`.
|
|
"""
|
|
@spec sanitize_like(String.t()) :: String.t()
|
|
def sanitize_like(query) do
|
|
query
|
|
|> String.replace("\\", "\\\\")
|
|
|> String.replace("%", "\\%")
|
|
|> String.replace("_", "\\_")
|
|
end
|
|
end
|