4 ms·
Please, if anyone's reading this, do not release a proof-of-concept until everyone has a chance to patch. (I sense there are a lot of already busy Rails develop
by teyc 14y ago
Please, if anyone's reading this, do not release a proof-of-concept until everyone has a chance to patch. (I sense there are a lot of already busy Rails developers today).
By the way, what do freelancers on HN feel about general responsibility for security maintenance after the work has been done?
- j-kidd 14y agoI have never done any Ruby / Rails development, but this exploit doesn't look like it requires any proof-of-concept. My understanding is that as long as there is a JSON endpoint accepting parameters, and the parameters are used for query generation without going through a proper validation layer [1], then the app is vulnerable. [1] In python, this would be things like FormEncode, WTForms, Colander, etc.