Description

This detector identifies Ecto SQL injection vulnerabilities in Elixir applications. It finds dangerous Ecto query functions where user input could be directly interpolated into SQL queries without proper parameterization, potentially allowing attackers to execute malicious SQL commands.

Detection Strategy

• Reports vulnerabilities when Ecto query functions (like query, fragment, or raw SQL operations) are called with potentially unsafe expressions

• Triggers when the detector identifies query sink functions that accept user-controllable input without proper sanitization or parameterization

• Activates specifically for Elixir code using the Ecto database library where SQL injection patterns are detected in query construction

Vulnerable code example

defmodule VulnerableExample do
  import Ecto.Query
  alias MyApp.Repo
  alias MyApp.User

  def vulnerable_fragment(email) do
    from u in User,
      where: fragment("email = '#{email}'")  # VULNERABLE: SQL interpolation in fragment...

✅ Secure code example

defmodule SecureExample do
  import Ecto.Query
  alias MyApp.Repo
  alias MyApp.User

  def secure_fragment(email) do
    from u in User,
      where: fragment("email = ?", ^email)  # SAFE: Parameterized fragment...