3 ms·
> To whit, if you look at the bug report it says that the problem is when an application is passing user-provided data into the framework. They say "don't do th
by awj 14y ago
> To whit, if you look at the bug report it says that the problem is when an application is passing user-provided data into the framework. They say "don't do that" and then apparently provide a patch to somehow get around if you don't
They never tell you not to pass in user provided data. I have no idea where you got that conclusion, but you're obviously off and running with it. Quit spreading misinformation.
The post includes a simple workaround for people who are not able to upgrade to a version that includes this security release. It's not a "don't do that" statement.
> To my mind, the problem is that Rails should be treating any data passed to it as user-provided data
It does. This is a bug. Please quit spreading misinformation.
- numbsafari 14y agoThis is the exact quote from the posting linked for this article: ---- Impacted code passes user provided data to a dynamic finder like this: Post.find_by_id(params[:id]) ---- It later tells you to apply the "to_s" function to the "user provided data" in order to avoid the problem. I'm unclear on how that is "misinformation".
- awj 14y agoIt tells you to do that in the "Workarounds" section when talking about how the vulnerability can be mitigated. At no point do they tell you not to pass user provided data to this method. The problem is an argument parsing bug that leads to user provided data being used as programmer provided data. Rails does not force SQL sanity off on the developer.