There's also an 'Unsafe Query Risk', which is not a CVE and does not have a patch.[0] I believe this script[1] should expose some of those dangerous columns. T

There's also an 'Unsafe Query Risk', which is not a CVE and does not have a patch.[0] I believe this script[1] should expose some of those dangerous columns. There's still the join alias risk, but I'm not sure, other than parsing a schema.rb, how to get at those effectively. [0] https://groups.google.com/forum/#!topic/rubyonrails-security/8CVoclw-Xkk https://groups.google.com/forum/#!topic/rubyonrails-security... [1] https://gist.github.com/KevinMcHugh/fab941ec3677f9a19ee0 https://gist.github.com/KevinMcHugh/fab941ec3677f9a19ee0