3 ms·
This is well documented and doesn't happen with good web practices. If you accept and trust user input, you fail. Summary of the exploit: If you accept a usern
by jeremysmyth 14y ago
This is well documented and doesn't happen with good web practices. If you accept and trust user input, you fail.
Summary of the exploit: If you accept a username from a browser that is (artificially, maliciously) submitted in a typed fashion (as a number or bool), and accept it as such, implicit conversion kicks in.
Both Rails and MySQL perform implicit conversion, so if you sanity check your apps to make sure the string you get from your browser or web service is in fact a string, there is no problem.
Or do you trust your web users?
- robconery 14y agoMost people used canned packages in Rails with something like Devise. Looking at the source it looks like the token is pulled right off the params: https://github.com/plataformatec/devise/blob/master/app/controllers/devise/passwords_controller.rb#L25 https://github.com/plataformatec/devise/blob/master/app/cont... The reset routine uses Rails finder mechanism to do just what the OP discusses: https://github.com/plataformatec/devise/blob/master/lib/devise/models/recoverable.rb#L124 https://github.com/plataformatec/devise/blob/master/lib/devi... I don't use MySQL because for reasons just like this - so I'm not all that surprised. That said - it would be interesting to see Devise put to the test to see if it is indeed a problem for Devise. This is not, however, a Rails issue.