4 ms·

If you didn't know that then let me share with you this interesting story from 2012. I'm going to repeat it from memory so my details may be a little fuzzy but

If you didn't know that then let me share with you this interesting story from 2012. I'm going to repeat it from memory so my details may be a little fuzzy but I'll include a link which should tell the story more faithfully. So back in 2012 rails had a default behavior where you could mass assign values from a POST to a user and there wasn't any scrubbing of that, by default. Someone realized this was a Bad Idea and issued a pull request that would have fixed it. Instead of accepting the PR, DHH (I think it was him) said something along the lines of 'competent programmers would not leave that setting in place' and rejected the PR. The exploit discoverer thought about this and tried it against github, which was known to run on rails and the code worked! From there he was able to manipulate the permissions on github to get access to the rails repo where he reopened and accepted his own pull request. He was promptly banned. https://gist.github.com/peternixey/1978249 https://gist.github.com/peternixey/1978249

dyeje 8y ago
This was a huge deal at the time, here's one of the HN threads. https://news.ycombinator.com/item?id=3663197 https://news.ycombinator.com/item?id=3663197
- tspike 8y ago
  Thanks for sharing, that was very entertaining.
orf 8y ago
Where is the actual pull request?
- powersurge360 8y ago
  Re-reading the material from that era I think I embellished a little in my memory. I think there was a pull request but he didn't reopen and accept it. Sounds like he just pushed a commit that said something along the lines of "why can I commit this to master". I'm busy at work so I can't dig in but I'm sure someone will find that original PR. If not tonight I'll see if I can't find it. EDIT: Went ahead and found it. It was an issue. https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228 EDIT2: It looks like DHH may have even gone so far as to delete his comments in this issue. There's folks referencing him and one side of a conversation in places. Pretty funny.
- ddeck 8y ago
  Commit: https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57 https://github.com/rails/rails/commit/b83965785db1eec019edf1... Github blog post on the incident: https://blog.github.com/2012-03-05-responsible-disclosure-policy/ https://blog.github.com/2012-03-05-responsible-disclosure-po...
  - ydnaclementine 8y ago
    seems like the origin story of strong params
wgerard 8y ago
Worth mentioning: Wasn't just a random person, it was Egor Homakov who has a history of finding pretty interesting exploits particularly wrt Rails and Github.

dyeje 8y ago

This was a huge deal at the time, here's one of the HN threads. https://news.ycombinator.com/item?id=3663197 https://news.ycombinator.com/item?id=3663197

tspike 8y ago
Thanks for sharing, that was very entertaining.

orf 8y ago

Where is the actual pull request?

powersurge360 8y ago
Re-reading the material from that era I think I embellished a little in my memory. I think there was a pull request but he didn't reopen and accept it. Sounds like he just pushed a commit that said something along the lines of "why can I commit this to master". I'm busy at work so I can't dig in but I'm sure someone will find that original PR. If not tonight I'll see if I can't find it. EDIT: Went ahead and found it. It was an issue. https://github.com/rails/rails/issues/5228 https://github.com/rails/rails/issues/5228 EDIT2: It looks like DHH may have even gone so far as to delete his comments in this issue. There's folks referencing him and one side of a conversation in places. Pretty funny.
ddeck 8y ago
Commit: https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57 https://github.com/rails/rails/commit/b83965785db1eec019edf1... Github blog post on the incident: https://blog.github.com/2012-03-05-responsible-disclosure-policy/ https://blog.github.com/2012-03-05-responsible-disclosure-po...
- ydnaclementine 8y ago
  seems like the origin story of strong params

wgerard 8y ago

Worth mentioning: Wasn't just a random person, it was Egor Homakov who has a history of finding pretty interesting exploits particularly wrt Rails and Github.