Module: SafeSqlExecutor

Defined in:
lib/safe_sql_executor.rb

Class Method Summary collapse

Class Method Details

.execute_select(query) ⇒ Object 



2
3
4
5
6
7
8
 
# File 'lib/safe_sql_executor.rb', line 2

def self.execute_select(query)
  # Validate the query
  validate_select_query(query)

  # Execute the query
  ActiveRecord::Base.connection.execute(query)
end

.validate_select_query(query) ⇒ Object 



12
13
14
15
16
17
18
19
 
# File 'lib/safe_sql_executor.rb', line 12

def self.validate_select_query(query)
  sanitized_query = query.strip.gsub(/\s+/, " ").upcase

  # Allow SELECT or WITH...SELECT queries
  unless sanitized_query.match?(/^(WITH .+)?SELECT /)
    raise ArgumentError, "Only SELECT queries (including with CTEs) are allowed"
  end
end