20 ms·

> Like many projects, Rails is continually discovering potential security problems, though I wouldn't say it is significantly worse than other comparable framew

by batiste 13y ago

> Like many projects, Rails is continually discovering potential security problems, though I wouldn't say it is significantly worse than other comparable frameworks/stacks Compared to Django, a framework similar both in feature and popularity, Rails is definitely worse. Especially compared with the most serious flaws (code execution, SQL injections). http://www.cvedetails.com/product/18211/Djangoproject-Django.html?vendor_id=10199 http://www.cvedetails.com/product/18211/Djangoproject-Django... http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-Rails.html?vendor_id=12043 http://www.cvedetails.com/product/22568/Rubyonrails-Ruby-On-... Not sure about the JSON incident you mention. Maybe you thought about YAML?

grey-area 13y ago
Thanks for the links, which I think would lead to a more productive discussion because they are a comparison of similar frameworks. There are of course difficulties with gauging how much attention each gets (a lower CVE count is not proof of security), but overall Django looks better here. I was thinking of the third one on this page (I suppose strictly speaking a vuln in a gem outside rails) which was pretty serious: http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12... but there was a related YAML bug too at the same time with serialize, which also allowed users to supply input that was then instantiated (madness!). Do lots of people use serialize? I've never explicitly used it, unless it is used behind the scenes somewhere. I remembered the fuss being over JSON because of broader impact but may have misremembered.