4 ms·

I just updated our app from 2.3.14 to 2.3.15, yet when I run your curl command I'm getting: Parameters: {"id"=>#<ActionController::Base:0xb570d2e8 @bar=1>}

I just updated our app from 2.3.14 to 2.3.15, yet when I run your curl command I'm getting: Parameters: {"id"=>#<ActionController::Base:0xb570d2e8 @bar=1>} Why do you think I'm still unprotected after updating to the fixed version 2.3.15 referenced here? http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/ http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3... Or is there something I'm missing?

vinhboy 14y ago
You should double check or restart your server or something. I tried it on 2.3.15 and I am getting Disallowed type attribute: "yaml"
- revacuate 14y ago
  Are you running this test against your development or production site? I can't get it to run against my production site, (nothing appears in the log at all,) but I have triple checked everything and am still getting the same unwanted result against my development site.
  - xenophanes 14y ago
    Are you maybe hitting a cached page on production that can get handled without rails being involved?
    - revacuate 14y ago
      Thank you, it turns out I was able to get the curl command to run against production site by adding the --insecure option and using the default port: curl -i -H "Content-Type: application/xml" -X POST -d '<id type="yaml">--- !ruby/object:ActionController::Base bar: 1</id>' --insecure https:localhost
- revacuate 14y ago
  This is what I had done: 1. Edit Gemfile and change rails version from 2.3.14 to 2.3.15. 2. Commit and push changes 3. bundle exec cap deploy (this is our standard method and works well.) 4. Double check rails -v returns 2.3.15 on production server. 5. On the production server run curl -i -H "Content-Type: application/xml" -X POST -d '<id type="yaml">--- !ruby/object:ActionController::Base bar: 1</id>' --insecure http://localhost Result: Parameters: {"id"=>#<ActionController::Base:0xb570d2e8 @bar=1>} Once I got the curl command to run against my production site (see my comment just below) and saw that it was still vulnerable, I quickly hacked ActionController::Base.param_parsers.delete(Mime::XML) into environments.rb and re-deployed and that fixed it. Now when I run the curl command I get a parameter-less GET request in the log. I still do not understand why updating to 2.3.15 per the recommended method did not fix the problem, but at least our app doesn't need the xml in that way.

vinhboy 14y ago

You should double check or restart your server or something. I tried it on 2.3.15 and I am getting Disallowed type attribute: "yaml"

revacuate 14y ago
Are you running this test against your development or production site? I can't get it to run against my production site, (nothing appears in the log at all,) but I have triple checked everything and am still getting the same unwanted result against my development site.
- xenophanes 14y ago
  Are you maybe hitting a cached page on production that can get handled without rails being involved?
  - revacuate 14y ago
    Thank you, it turns out I was able to get the curl command to run against production site by adding the --insecure option and using the default port: curl -i -H "Content-Type: application/xml" -X POST -d '<id type="yaml">--- !ruby/object:ActionController::Base bar: 1</id>' --insecure https:localhost
revacuate 14y ago
This is what I had done: 1. Edit Gemfile and change rails version from 2.3.14 to 2.3.15. 2. Commit and push changes 3. bundle exec cap deploy (this is our standard method and works well.) 4. Double check rails -v returns 2.3.15 on production server. 5. On the production server run curl -i -H "Content-Type: application/xml" -X POST -d '<id type="yaml">--- !ruby/object:ActionController::Base bar: 1</id>' --insecure http://localhost Result: Parameters: {"id"=>#<ActionController::Base:0xb570d2e8 @bar=1>} Once I got the curl command to run against my production site (see my comment just below) and saw that it was still vulnerable, I quickly hacked ActionController::Base.param_parsers.delete(Mime::XML) into environments.rb and re-deployed and that fixed it. Now when I run the curl command I get a parameter-less GET request in the log. I still do not understand why updating to 2.3.15 per the recommended method did not fix the problem, but at least our app doesn't need the xml in that way.