ruby 47 lines · 8 steps

Building a safe filterable product index in Rails

A chainable query that whitelists filters, sorting, and pagination to turn untrusted params into a safe ActiveRecord relation.

Explained by highlit
Rails Intermediate query objects scopes strong parameters pagination dynamic queries
1class ProductsController < ApplicationController
2 def index
3 @products = Product
4 .includes(:category, :brand)
5 .filter_by(filter_params)
6 .order(sort_column => sort_direction)
7 .page(params[:page])
8 .per(25)
9 end
10 
11 private
12 
13 def filter_params
14 params.fetch(:q, {}).permit(
15 :name_cont, :category_id_eq, :brand_id_in,
16 :price_gteq, :price_lteq, :active_eq
17 )
18 end
19 
20 def sort_column
21 %w[name price created_at].include?(params[:sort]) ? params[:sort] : :created_at
22 end
23 
24 def sort_direction
25 %w[asc desc].include?(params[:direction]) ? params[:direction] : :desc
26 end
27end
28 
29class Product < ApplicationRecord
30 belongs_to :category
31 belongs_to :brand
32 
33 scope :filter_by, ->(filters) {
34 filters.compact_blank.reduce(all) do |relation, (key, value)|
35 attribute, predicate = key.to_s.rpartition("_").values_at(0, 2)
36 
37 case predicate
38 when "cont" then relation.where("#{attribute} ILIKE ?", "%#{value}%")
39 when "eq" then relation.where(attribute => value)
40 when "in" then relation.where(attribute => Array(value))
41 when "gteq" then relation.where("#{attribute} >= ?", value)
42 when "lteq" then relation.where("#{attribute} <= ?", value)
43 else relation
44 end
45 end
46 }
47end
01 / 01
STEP 01

Walkthrough

Space play ←→ step click any line
Three takeaways
  1. 1Whitelisting both attributes and predicates keeps user-driven queries safe from SQL injection.
  2. 2Reducing over filters lets you compose an arbitrary WHERE clause from a single permitted hash.
  3. 3Eager loading plus pagination keeps a flexible index endpoint fast and N+1-free.

Related explainers

ruby 
require "shellwords"
require "open3"
 
module Backup

Building safe shell commands in Ruby

shell-out subprocess command-injection
Intermediate 7 steps
ruby 
class UserAgentParser
  BROWSERS = [
    [/Edg\/([\d.]+)/, "Edge"],
    [/OPR\/([\d.]+)/, "Opera"],

Parsing user-agent strings in Ruby

regex pattern-matching lookup-tables
Intermediate 8 steps
ruby 
class LogAggregator
  BUCKET_FORMAT = "%Y-%m-%dT%H:%M"
 
  def initialize(entries)

Bucketing log entries by the minute in Ruby

aggregation hashing enumerable
Intermediate 5 steps
ruby 
class WeeklySignupsReport
  DEFAULT_WEEKS = 12
 
  def initialize(weeks: DEFAULT_WEEKS, source: User.all)

Building a weekly signups report in Rails

service object aggregation group by
Intermediate 7 steps
ruby 
class ApplicationController < ActionController::Base
  EXPERIMENTS = {
    checkout_button_color: %w[control blue green],
    onboarding_flow: %w[control streamlined]

How A/B test cohorts are assigned in Rails

a-b-testing cookies hashing
Intermediate 8 steps
ruby 
class SnippetHighlighter
  CONTEXT_RADIUS = 60
  MAX_TERMS = 8
 

Building search-result snippets in Ruby

regular-expressions text-processing search
Intermediate 9 steps

Share this explainer

Here's the card — post it anywhere.

Building a safe filterable product index in Rails — share card
Made with highlit — turn any snippet into a walkthrough like this in about a minute.
Explain your code