⚠️ Potential issue

Critical: Fix SQL injection vulnerability

The current implementation is vulnerable to SQL injection attacks. User input from params[:email] is directly interpolated into the SQL query string, allowing malicious users to execute arbitrary SQL commands.

Apply this fix to use parameterized queries:

-    @users = User.where("email = '#{params[:email]}'")
+    @users = User.where(email: params[:email])

Alternatively, if you need to use SQL fragments:

@users = User.where("email = ?", params[:email])

In app/controllers/users_controllers.rb at line 3, the current code directly
interpolates user input into the SQL query, causing a SQL injection
vulnerability. To fix this, replace the string interpolation with a
parameterized query by using a placeholder and passing params[:email] as a
separate argument, like User.where("email = ?", params[:email]). This change
ensures safe query execution by properly escaping user input.

💡 Verification agent

#!/bin/bash
# Description: Check for references to the incorrectly named file

# Search for any references to the incorrect filename
rg -i "users_controllers" --type ruby

# Check if the correct filename already exists
fd -t f "users_controller.rb"

#!/bin/bash
# List all Ruby files under app/controllers to verify the actual filenames
fd -e rb app/controllers

# Search for files defining UsersController to pinpoint where the class is declared
rg -l "class UsersController" --type ruby

Fix file naming convention and improve controller

The controller file is misnamed and missing essential safeguards:

• Rename

  • app/controllers/users_controllers.rb → app/controllers/users_controller.rb
    No references to the old filename were found, but Rails autoloading will break until the file is renamed.

• Add authorization

  • e.g.

    class UsersController < ApplicationController
      before_action :authenticate_user!         # Devise
      # or
      # after_action  :verify_authorized, except: :index  # Pundit

  • Inside index, call your authorization library (e.g. authorize User).

• Add pagination

  • Prevent unbounded result sets:

    def index
      @users = User.where(email: params[:email])
                   .page(params[:page])
                   .per(params[:per_page] || 25)
    end

  • Requires a pagination gem like Kaminari or WillPaginate.

In app/controllers/users_controllers.rb lines 1 to 5, rename the file to
users_controller.rb to follow Rails naming conventions and avoid autoloading
issues. Add an authorization callback such as before_action :authenticate_user!
or after_action :verify_authorized to secure the controller. Modify the index
action to use parameterized queries (e.g., User.where(email: params[:email])) to
prevent SQL injection, and add pagination using a gem like Kaminari by chaining
.page(params[:page]).per(params[:per_page] || 25) to limit result sets.