Rails Security Audit — Findings Report

app/models/order.rb:34

The `search` scope builds a WHERE clause by interpolating user input directly into the SQL string. Any value passed to the search box reaches the database unescaped.

Impact: An attacker can read arbitrary rows from any table — including password digests and API tokens — or modify data, using nothing but the public search field.

- scope :search, ->(q) { where("reference LIKE '%#{q}%'") }
+ scope :search, ->(q) { where("reference LIKE ?", "%#{Order.sanitize_sql_like(q)}%") }

app/controllers/admin/users_controller.rb:52

`params.require(:user).permit!` whitelists every attribute, including `role` and `admin` flags. Any request that reaches this action can set any column on User.

Impact: A compromised or malicious staff account can escalate itself (or any user) to full admin by adding one form field to the request.

- def user_params
-   params.require(:user).permit!
- end
+ def user_params
+   params.require(:user).permit(:name, :email, :department_id)
+ end

config/environments/production.rb

The session cookie is issued without `secure: true` and `httponly: true`, so it can travel over plain HTTP and is readable from JavaScript.

Impact: On any shared or intercepted network, the session token can be captured and replayed; an XSS bug anywhere on the site immediately becomes full account takeover.

+ config.session_store :cookie_store,
+   key: "_app_session",
+   secure: true,
+   httponly: true,
+   same_site: :lax

Gemfile.lock — nokogiri 1.13.x

The locked nokogiri version carries a published low-severity ReDoS advisory in its bundled libxml2. No exploit path was found in this app's current usage, but the dependency is two minor versions behind.

Impact: Crafted input to any future XML/HTML parsing path could pin a worker process. Low today; cheap to eliminate now.

# Gemfile
- gem "nokogiri", "~> 1.13.0"
+ gem "nokogiri", "~> 1.16"
# then: bundle update nokogiri && bundle exec rspec