Is SQL Injection possible here?

Question

I have run a static code analysis tool (brakeman) on a rails app and it has reported some SQL Injection vulnerabilities which I suspect may be false positives. The offending lines look like this:

#things_controller.rb

def index
  Thing.select(params[:columns]).where(params[:conditions])
end

I can't figure a way to exploit this, but it does seem rather open-ended, is this safe enough (this controller requires admin access anyway) or can it be exploited?

Ruby is 2.0.0-p247, Rails is 4.0.0

Answer 1

While rails has some built-in filters for special characters, this is definitely vulnerable:

http://guides.rubyonrails.org/security.html#sql-injection

If you want to test it yourself, run a full scan with sqlmap using the url of this action with a conditions GET parameter