3 ms·
This is the exact quote from the posting linked for this article: ---- Impacted code passes user provided data to a dynamic finder like this: Post.find_by_id(
by numbsafari 14y ago
This is the exact quote from the posting linked for this article:
----
Impacted code passes user provided data to a dynamic finder like this:
Post.find_by_id(params[:id])
----
It later tells you to apply the "to_s" function to the "user provided data" in order to avoid the problem.
I'm unclear on how that is "misinformation".
- awj 14y agoIt tells you to do that in the "Workarounds" section when talking about how the vulnerability can be mitigated. At no point do they tell you not to pass user provided data to this method. The problem is an argument parsing bug that leads to user provided data being used as programmer provided data. Rails does not force SQL sanity off on the developer.