5 ms·
The linked pull request described a method for getting unescaped code into the application so the issue with find_by_id might be exploited. Have you got anothe
by venus 14y ago
The linked pull request described a method for getting unescaped code into the application so the issue with find_by_id might be exploited.
Have you got another way of getting unescaped code into the application such that this issue might be exploited? If so, the core team will be very, very interested to hear from you.
- numbsafari 14y agoI've been going through the code for ActiveRecord and now AuthLogic. I'm admittedly not well versed in Ruby. However from the description of the vulnerability found at [1], it would appear as though the cookie value can be set to a Ruby string value that is then parsed by server to produce a Ruby Hash value (rather than the AuthLogic plugin's assumed string value). Is the eval() of the cookie value done by Rails or is it done by AuthLogic? Is that a potential security vulnerability in itself? [1]http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html http://phenoelit.org/blog/archives/2012/12/21/let_me_github_... edit: forgot the URL edit2: nvm ... apparently it's using the Ruby Marshal API, not an eval()-type call. http://stackoverflow.com/a/2241740 http://stackoverflow.com/a/2241740
- deleted 14y ago[deleted]
- deleted 14y ago[deleted]