New Check: preventing LIKE-injections in Ecto

[thbar]

What do you want Credo to do?

See:

• https://hexdocs.pm/ecto/Ecto.Query.API.html#like/2

You should be very careful when allowing user sent data to be used as part of LIKE query, since they allow to perform LIKE-injections.

During a code review today, I thought it would have been nice to be warned about that, and that the infrastructure available in Credo could probably help detect cases like:

def search(%{"q" => q}) do
    ilike_search = "%#{q}%"
    # ...
    |> where([contact: c], ilike(c.organization, ^ilike_search))

I am not sure exactly how, and if this is "easy" to implement as a Credo check, but it would be quite nice to get such alerts. Maybe a security scanner is a better place?

[thbar]

Maybe https://github.com/nccgroup/sobelow/issues is a better place for this, just launching the discussion here.