KogenCredo.Check.Warning.UnescapedLikeInput (KogenCredo v0.1.0)

Basics

This check has a base priority of low and works with any version of Elixir.

Explanation

A LIKE pattern built from input without escaping lets the input contain wildcards.

Bad:

where(q, [u], ilike(u.name, ^"%#{term}%"))

Good:

where(q, [u], ilike(u.name, ^"%#{escape_like(term)}%"))

where escape_like/1 escapes \, % and _. Heuristic: only patterns with an author-written wildcard plus dynamic input are reported.

Check-Specific Parameters

Use the following parameters to configure this check:

:like_functions

Query functions that take a LIKE pattern as 2nd argument.

This parameter defaults to [:like, :ilike].

:escape_functions

Function names that escape LIKE input (matched by name).

This parameter defaults to ["escape_like", "sanitize_like", "escape_like_pattern", "like_escape", "escape_wildcards"].

:included_paths

Globs of files to check; empty means every file.

This parameter defaults to [].

:excluded_paths

Globs of files to skip (default ["test/**"]).

This parameter defaults to ["test/**"].

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.