4 ms·
I'd like to point out that this is not a rails vulnerability, but a mistake Github engineers made, which happens to the best of us. Mass assignment is a feature
by oscardelben 15y ago
I'd like to point out that this is not a rails vulnerability, but a mistake Github engineers made, which happens to the best of us. Mass assignment is a feature and I guarantee the problem has been know for years and Github engineers were probably well aware of it.
- lucian1900 15y agoIt most certainly is a vulnerability in rails, by encouraging bad practice by design. Mass assignment should work by defaulting attributes to protected, if it should exist at all.
- anthonyb 15y agoAnd yet they still fell prey to it. Insecure by default is not secure, even if you can fix the insecurities.
- jarek 15y agoThe same way magic_quotes was a "feature".