The area, p_every_days, p_since_days, and judge parameters in regularly.rb (lines 38-43) and repeatedly.rb (lines 40-45) are interpolated directly into Factbase query strings without any escaping. A value containing single quotes (e.g. area = "it's_broken") will break the query syntax or produce incorrect results. The interval value from PMP is also interpolated as-is without numeric validation.
REPRODUCTION: Call Fbe.regularly with area = "it's_broken" — the query becomes malformed: (eq area 'it's_broken'). Same applies to Fbe.repeatedly.
IMPACT: RuntimeError from Factbase parse failure; incorrect query matching; potential data integrity issues if the query silently matches wrong facts.
The area, p_every_days, p_since_days, and judge parameters in regularly.rb (lines 38-43) and repeatedly.rb (lines 40-45) are interpolated directly into Factbase query strings without any escaping. A value containing single quotes (e.g. area = "it's_broken") will break the query syntax or produce incorrect results. The interval value from PMP is also interpolated as-is without numeric validation.
REPRODUCTION: Call Fbe.regularly with area = "it's_broken" — the query becomes malformed: (eq area 'it's_broken'). Same applies to Fbe.repeatedly.
IMPACT: RuntimeError from Factbase parse failure; incorrect query matching; potential data integrity issues if the query silently matches wrong facts.