3 ms·

what is bypass?

• tinco 14y ago
  it means it was circumvented, i.e. you evaded the piece of code that was supposed to lock you out. In this case, apparently it was possible to 'hide' your attribute behind a newline, making it invisible to the attr_protected code, but somehow the attribute could still be valid (for no reason rails calls #strip on it or something?).
  • homakov 14y ago
    that's why I asked. I know attribute_assignment.rb code pretty well - no strip is called. So conclusion: this doesn't lead to mass assignment. only DoS.
    • benmmurphy 14y ago
      i can't actually explain why it works but it does work. I think it is result of both of the buggy regular expressions.
      • homakov 14y ago
        i am checking agains rails 4. [29] pry(main)> x.update_attributes("client_\nsecret"=>1) (0.1ms) begin transaction (0.1ms) rollback transaction ActiveRecord::UnknownAttributeError: unknown attribute: client_ secret But DEPRECATION WARNING: The method `sdf client_secret=', matching the attribute `client_secret' has dispatched through method_missing. This shouldn't happen, because `client_secret' is a column of the table. If this error has happened through normal usage of Active Record (rather than through your own code or external libraries), please report it as a bug. (called from block in assign_attributes at /Users/homakov/.rvm/gems/ruby-1.9.3-p194/bundler/gems/protected_attributes-369818eedeaa/lib/active_record/mass_assignment_security/attribute_assignment.rb:67) So it's hidden in method_missing!
      • homakov 14y ago
        so there is a chain: "notprotected\nprotected" it's not found in include? so tryes to assign, then method_missing parses it and founds another attribute just below the first one.