5 ms·
So I'm digging around in the Rack source right now trying to see what's up, I haven't seen anywhere that it doesn't just rely on the native Ruby Hash class. Do
by adrianpike 15y ago
So I'm digging around in the Rack source right now trying to see what's up, I haven't seen anywhere that it doesn't just rely on the native Ruby Hash class.
Does anybody closer to the matter know if Rack's actually vulnerable in 1.9?
- deleted 15y ago[deleted]
- charliesome 15y agoTFA says Ruby 1.9.x isn't vulnerable because its hash function is randomized
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- rmoriz 15y agoAs far as I understand, Rack is not vulnerable unless the underlaying Ruby interpreter is vulnerable, like old 1.8, Rubinius, older JRuby. Rack introduced a workaround in https://github.com/rack/rack/commit/5b9d09a81a9fdc9475f0ab0095cb2a33bf2a8f91 https://github.com/rack/rack/commit/5b9d09a81a9fdc9475f0ab00... this may help in some cases when an interpreter fix is not available/installable but not fix the hashing problem in general, especially outside of POST params.