5 ms·

Rails param parsing automatically converts all param keys to symbols.

oomkiller 14y ago
If I submit a form where the param is "login[select]=* from users limit 1 --" when I inspect params[:login] I get {"select"=>"* from users limit 1 --"}. Is there a different way of submitting things that converts it to symbols? params[:login] works due to it being a HashWithIndifferentAccess
- mnarayan01 14y ago
  Yea I'm not seeing it either. Maybe if someone explicitly called `params.symbolize_keys!`? If that's the only time its vulnerable it seems like less of a big deal, though still obviously something that should be patched ASAP. edit: Above sandstrom posts the link to https://github.com/binarylogic/authlogic/pull/341 https://github.com/binarylogic/authlogic/pull/341 so I guess maybe you can use the session to do this, though you would need access to the secret_token.
charliesome 14y ago
The param keys remain strings underneath.
mnarayan01 14y ago
Just to expand on what others have already said...Rails converts params to http://api.rubyonrails.org/classes/ActiveSupport/HashWithIndifferentAccess.html http://api.rubyonrails.org/classes/ActiveSupport/HashWithInd... which means that `params[:foo]` and `params["foo"]` will both return the same thing. The function [`assert_valid_keys`](http://api.rubyonrails.org/classes/Hash.html#method-i-assert_valid_keys http://api.rubyonrails.org/classes/Hash.html#method-i-assert...), which is called in [`apply_finder_options`](http://api.rubyonrails.org/classes/ActiveRecord/SpawnMethods.html#method-i-apply_finder_options http://api.rubyonrails.org/classes/ActiveRecord/SpawnMethods...) does not, however, treat symbol and string keys as the same, even if given a `HashWithIndifferentAccess`.
- xentronium 14y ago
  To expand on your expansion: when a hash with indifferent access is asserted over a list of symbols (as is the keys) it will always fail. 1.9.3p327 :025 > {:a => "b"}.with_indifferent_access.assert_valid_keys([:a]) ArgumentError: Unknown key: a
waffle_ss 14y ago
No, it's a bit more elaborate than that. If what you said were strictly true you could DoS any Rails app as symbols are never garbage collected - you could just continue sending new param keys to the app until it runs out of memory.

If I submit a form where the param is "login[select]=* from users limit 1 --" when I inspect params[:login] I get {"select"=>"* from users limit 1 --"}. Is there a different way of submitting things that converts it to symbols? params[:login] works due to it being a HashWithIndifferentAccess

mnarayan01 14y ago
Yea I'm not seeing it either. Maybe if someone explicitly called `params.symbolize_keys!`? If that's the only time its vulnerable it seems like less of a big deal, though still obviously something that should be patched ASAP. edit: Above sandstrom posts the link to https://github.com/binarylogic/authlogic/pull/341 https://github.com/binarylogic/authlogic/pull/341 so I guess maybe you can use the session to do this, though you would need access to the secret_token.

charliesome 14y ago

The param keys remain strings underneath.

mnarayan01 14y ago

Just to expand on what others have already said...Rails converts params to http://api.rubyonrails.org/classes/ActiveSupport/HashWithIndifferentAccess.html http://api.rubyonrails.org/classes/ActiveSupport/HashWithInd... which means that `params[:foo]` and `params["foo"]` will both return the same thing. The function [`assert_valid_keys`](http://api.rubyonrails.org/classes/Hash.html#method-i-assert_valid_keys http://api.rubyonrails.org/classes/Hash.html#method-i-assert...), which is called in [`apply_finder_options`](http://api.rubyonrails.org/classes/ActiveRecord/SpawnMethods.html#method-i-apply_finder_options http://api.rubyonrails.org/classes/ActiveRecord/SpawnMethods...) does not, however, treat symbol and string keys as the same, even if given a `HashWithIndifferentAccess`.

xentronium 14y ago
To expand on your expansion: when a hash with indifferent access is asserted over a list of symbols (as is the keys) it will always fail. 1.9.3p327 :025 > {:a => "b"}.with_indifferent_access.assert_valid_keys([:a]) ArgumentError: Unknown key: a

waffle_ss 14y ago

No, it's a bit more elaborate than that. If what you said were strictly true you could DoS any Rails app as symbols are never garbage collected - you could just continue sending new param keys to the app until it runs out of memory.