3 ms·

This bug is pretty edge, but if there was an easy way for a user to put a symbol in the params hash the bug would be a pretty gnarly universal SQL injection vul

by mef 14y ago

This bug is pretty edge, but if there was an easy way for a user to put a symbol in the params hash the bug would be a pretty gnarly universal SQL injection vulnerability for all versions of Rails. Though if that was easy it would most likely have been caught much, much earlier as there are a multitude of find helpers that allow literal SQL to be injected.

FooBarWidget 14y ago
Early versions of Rails explicitly made the decision to never symbolize user inputted hashes because symbols are never garbage collected. This would allow memory to grow unbounded. As a result Rails stores all user hash keys as strings.
- phillc 14y ago
  Thank you... I always wondered why that was true.
- alxndr 14y ago
  Ah, I also wondered about that. Is that why HashWithIndifferentAccess uses strings internally?
- peterwoo 14y ago
  So it's just serendipitous that this isn't the obvious and massive vulnerability it initially seemed to be.
scanr 14y ago
There are suggestions that it is possible (potentially easy) for a user to get symbols into the params hash.