3 ms·
Hope you're not using default model binder, because M$ still allows for you to hang yourself with mass assignment attacks. Something they have yet to learn. Hop
by gregors 14y ago
Hope you're not using default model binder, because M$ still allows for you to hang yourself with mass assignment attacks. Something they have yet to learn. Hope you're not running MVC 1 or MVC 2, you're still open to redirection attacks.
It's not called patch Tuesday for nothing.
- meaty 14y agoWe have our own model binder implementation (with circuit breakers) and UI framework and are using mvc3. And yes we're always fully patched.
- gregors 14y agoReally that's the point I'm trying to make. The default path in MVC isn't exactly secure. There is work to be done. I'd consider this particular rails update in line with a patch Tuesday update. Though I will say, I wish they had a better way of communicating when updates were available.