3 ms·
You say "standard Rails-fu", I say security hole. Let's call the whole thing off?
by ubernostrum 14y ago
You say "standard Rails-fu", I say security hole. Let's call the whole thing off?
- tomjen3 14y agoNo because you don't know what you are talking about.
- ubernostrum 14y agoI see. So that whole big mass-assignment security issue that exposed GitHub a while back -- that just didn't happen? Writing code in this style is perfectly safe?
- bryanlarsen 14y agoWriting code in this style is perfectly safe if you do it correctly. GitHub didn't, so the defaults were changed to make it harder to do it incorrectly. UPDATE: editing to reply since hn won't let me reply directly because the thread is to deep, yet I'm getting downvotes It's not a tautology. Some things are safe even if you do them wrong. Some things are unsafe no matter how you do them. Rails changed the defaults so that now you have to deliberately decide to do things unsafely. Rails before 3.2.3 fails un-safe in this scenario, but later versions fail safe. Rails 4 uses a different solution that's even harder to screw up.
- jerf 14y ago"Writing code in this style is perfectly safe if you do it correctly." That's a tautology. In general you can't count on code being written "correctly", so this isn't a defense. It is better to have systems that degrade gracefully in the face of humans and their idiosyncrasies, rather than those that fail-unsafe, because you can't build your security system on the assumption that your code will be written by superhumans.
- tomjen3 14y agoShould all database use be frowned upon because injections are possible if you don't use them correctly?
- Pewpewarrows 14y agoI hope you realize that this is the identical argument PHP developers made whenever someone brought up how insecure the base language, libraries, and configuration were. Users of a framework should have to go out of their way to make themselves insecure. It shouldn't be insecure by default.
- untog 14y agoThis isn't a Rails issue, it can affect any web framework. And it's a security flaw every single time mass assignment is used without whitelisting.
- masklinn 14y ago> This isn't a Rails issue, it can affect any web framework. Not exactly. Most web frameworks don't have a built-in "mass assignment", let alone enable it by default.
- untog 14y agoWell, true. I wonder how many people pass their models straight into a schema-less database without any checks?