3 ms·
Totally avoidable via `Hash#slice`. Come on guys, this is common knowledge now. def update find_pk.update_attributes(params[:public_key].slice(...))
by jayferd 15y ago
Totally avoidable via `Hash#slice`. Come on guys, this is common knowledge now.
def update
find_pk.update_attributes(params[:public_key].slice(...))
end
- ajross 15y agoMissing the point. You have a code idiom that is insecure by default. Leaving out the slice produces working code with a critical vulnerability. Mistakes of omission are routine; people forget stuff all the time. The goal of a secure framework is to be tolerant of that kind of goof. This API sucks rocks.