5 ms·
Different issue altogether. It was mass-assignment wherein the default Rails config did not have the whitelist enabled by default. The howto is here: http://ho
by purephase 14y ago
Different issue altogether. It was mass-assignment wherein the default Rails config did not have the whitelist enabled by default. The howto is here:
http://homakov.blogspot.ca/2012/03/how-to.html http://homakov.blogspot.ca/2012/03/how-to.html
- chimeracoder 14y agoI know it was a different vulnerability - I was asking more whether the same developer(s) was/were responsible, since this seems to be a comment pattern that I'm hearing with regards to the initial response to the vulnerabilities.
- tomjen3 14y agoActually it is the same issue as basically all other security issues in web programming (attack on crypto aside): Failure to blacklist non-conforming input. Really, it is that simple and that complicated.
- dos1 14y agoWouldn't whitelisting conforming input be a better approach? I realize it may be more difficult, but wouldn't that be more secure? Edit: I'm genuinely interested - I always try and whitelist things when I'm building software. Although I have next to no background when it comes to security in particular.
- purephase 14y agoWhitelisting is what Rails did to get around the mass assignment issue. It was solved for awhile, it just was not the default configuration setting. Whitelisting is what the rubygems folks are doing to work around this problem until a better implementation is put in-place in the YAML parser. Generally, it is a better solution but it is more difficult and can break a lot of dependencies if not implemented correctly.
- tomjen3 14y agoStupid me. I meant to write whitelisting. Yes, you are absolutely right.