Sql injection from brakeman for Order by field in rails

rubyonrails-talk
1

Rails version: 5.1.7

Getting Brakeman vulnerability warning for order by field with where clause query in rails Can, anyone help me to resolve this issue? Thanks in advance

Query for your reference: DropdownValue.where(:dropdown_id => PreferenceValue.find(params[:id]).preference.dropdown_id).order(“field(id, #{PreferenceValue.find(params[:id]).dropdown_value_ids.join(”,“)})”)

2

That is injected, I would not be doing an unsafe .order like that.