Company
Date Published
Author
Ben Toews
Word count
732
Language
English
Hacker News points
None

Summary

The text discusses an issue encountered with a slow SQL query in a Ruby on Rails application, highlighting a potential performance problem related to unsanitized user input in LIKE clauses. The concern arose when a query with a user-provided term containing multiple percent signs led to slow query performance, prompting an investigation into the impact of wildcard placements on database indexing. To address the lack of built-in Rails helpers for escaping LIKE metacharacters, custom methods were developed to sanitize user inputs in SQL LIKE queries, thereby reducing the risk of Denial of Service (DoS) vulnerabilities. Although the risk was relatively low, the potential for application-level DoS was identified as a significant concern, emphasizing the need for mitigation strategies. The text concludes by noting that Rails 4.2 introduced a sanitize_sql_like helper to aid in resolving such issues.