4 ms·

What makes you think RoR was built by people with no understanding of security? Rails was one of the first frameworks to do things right (CSRF protection comes

What makes you think RoR was built by people with no understanding of security? Rails was one of the first frameworks to do things right (CSRF protection comes to mind).

batiste 14y ago
I was looking for the date when RoR changed their templating so it always output sanitized content and I found this: http://stackoverflow.com/questions/698700/escaping-html-in-rails http://stackoverflow.com/questions/698700/escaping-html-in-r... Correct me if I am wrong but it seems to me that RoR still isn't shipped with a safe default? Edit: RoR added auto-escaping around February 2010, Django had it since November 2007 http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=9 https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=...
- grey-area 14y ago
  You're wrong. It has auto-escaped since Rails 3. http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/
- rscale 14y ago
  Rails changed the default to safe output about three years ago. 3.0 escaped output out of the gate, and 2.3 switched the default in the 2.3.6 neighborhood. Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.
tomjen3 14y ago
Their (abuse) of the Yaml parser. It is one thing to use a potentially dangerous parser on a file that you aren't going to let anybody touch either (your database config); it is downright stupid to use a dangerous parser on untrused user input (json) a format it shouldn't even parse to begin with. And as of late tons of similar bugs have been found. CSRF and database parameterization was well known issues when Rails was written, so yeah props for that. It is just not enough anymore.

What makes you think RoR was built by people with no understanding of security? Rails was one of the first frameworks to do things right (CSRF protection comes to mind).

batiste 14y ago

I was looking for the date when RoR changed their templating so it always output sanitized content and I found this: http://stackoverflow.com/questions/698700/escaping-html-in-rails http://stackoverflow.com/questions/698700/escaping-html-in-r... Correct me if I am wrong but it seems to me that RoR still isn't shipped with a safe default? Edit: RoR added auto-escaping around February 2010, Django had it since November 2007 http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=9 https://code.djangoproject.com/wiki/AutoEscaping?x=52&y=...

grey-area 14y ago
You're wrong. It has auto-escaped since Rails 3. http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/ http://yehudakatz.com/2010/02/01/safebuffers-and-rails-3-0/
rscale 14y ago
Rails changed the default to safe output about three years ago. 3.0 escaped output out of the gate, and 2.3 switched the default in the 2.3.6 neighborhood. Prior before that, the standard way to sanitize html output was to write <%= h foo %> instead of <%= foo %> in your templates.

tomjen3 14y ago

Their (abuse) of the Yaml parser. It is one thing to use a potentially dangerous parser on a file that you aren't going to let anybody touch either (your database config); it is downright stupid to use a dangerous parser on untrused user input (json) a format it shouldn't even parse to begin with. And as of late tons of similar bugs have been found. CSRF and database parameterization was well known issues when Rails was written, so yeah props for that. It is just not enough anymore.