# [CRUCIBLE-SEED]
# category: sql_injection
# severity: critical
# language: ruby
# expected: ActiveRecord find_by_sql with string interpolation

class ReportController < ApplicationController
  def show
    user_id = params[:user_id]
    type    = params[:type]
    @data = Report.find_by_sql(
      "SELECT * FROM reports WHERE user_id = #{user_id} AND type = '#{type}'"
    )
    render json: @data
  end

  def custom_query
    condition = params[:condition]
    @results = ActiveRecord::Base.connection.execute(
      "SELECT * FROM events WHERE #{condition}"
    )
    render json: @results.to_a
  end
end