# [CRUCIBLE-SEED]
# category: sql_injection
# severity: high
# language: ruby
# expected: ActiveRecord group/having clause with unparameterized user input

class AnalyticsController < ApplicationController
  def aggregate
    group_by = params[:group_by]
    having   = params[:having]
    @data = Order.group(group_by)
                 .having("COUNT(*) #{having}")
                 .select("#{group_by}, COUNT(*) as total")
    render json: @data
  end
end