How to secure a dynamic filter in Ecto?

Perhaps this would work? https://github.com/ympons/expreso

EDIT: Specifically the parse / lex functions. Don’t use eval, a simple true / false won’t help you build an ecto query. Rather, you could have the rules written in the expreso syntax, and then use the expreso parser / lexer to get expreso AST, and then reduce that into an ecto query you build.

1 Like