4 ms·
No. SQL Server, Oracle, IBM and other NoSQL databases. Everything that runs on Rails that is not SQLite3 or PostgreSQL requires an upgrade.
by josevalim 14y ago
No. SQL Server, Oracle, IBM and other NoSQL databases. Everything that runs on Rails that is not SQLite3 or PostgreSQL requires an upgrade.
- michaelbuckbee 14y agoThat's really interesting/terrifying - I wouldn't have suspected NoSQL datastores to be susceptible. Now I'm really interested in seeing what the root cause was.
- josevalim 14y agoUnfortunately, the problem is not only the NoSQL data stores but their ORMs. In fact, Devise was not vulnerable to any of the Rails previous vulnerabilities because MongoDB ORMs forced us a long time ago to sanitize all input values because if you do this: User.where(password_token: params[:password_token]) You could make `params[:password_token]` return `{ "$ne" => "1" }` and effectively get any record from the database in MongoDB ORMs. So we limit the set of input values you can pass as argument for a while now. This is also why our patches were so simply, the whole sanitization infra structure was already there. We were not able to test all ORMs and databases (because we would need to effectively test combinations of those) but we could verify the problem does not happen for PostgreSQL nor SQLite3. That's why you must upgrade if you don't want to take any risks.
- tptacek 14y agoWhat NoSQL database is vulnerable to this flaw?