4 ms·
Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL
- bni 12y agoSo Active Record is building its SQL from string concatenation, not using prepared statements with bind variables?
- streptomycin 12y agoNot uncommon, for instance with MySQL in Python: http://stackoverflow.com/questions/2424531/does-the-mysqldb-module-support-prepared-statements http://stackoverflow.com/questions/2424531/does-the-mysqldb-...
- joevandyk 12y agoNo, ActiveRecord uses bind variables. It uses prepared statements in some cases.
- simonw 12y agoAll ORMs build at least some of their SQL using string concatenation. Prepared statements with bind variables only work when the SQL string is static and only the variables change - but ORMS are used to construct full SQL statements with custom select / while / join clauses etc.
- jerf 12y agoNo, you just have to use some intelligence in tracking your bind variables and bind values together instead of blindly bashing strings together, then at some distant location in the code guess & hope about the number of bind values used. I've got code that does it just fine.
- GVIrish 12y agoNo you can definitely use prepared statements with bind variables since you can dynamically name the bind variables. So if you have a statement where you don't know how many bind variables will go into the query you can give the bind variable a name and add a number at the end that you increment for each additional bind variable (e.g. @param + i for @param1, @param2, @param3, etc.). Depending on how complex your query is it can get to be a bit of work but it's doable.
- X-Istence 12y agoYes, all ORM's build their SQL using string concatenation, BUT the good ORM's won't use string concatenation on user data, instead they will use bind parameters. This way the query sent to the server looks like this: SELECT * FROM whatever WHERE email = :1 AND user_name = :2; And then the parameters are passed to the database server separately to bind to the above placeholders. This way the database server knows what is user provided data and what is part of the SQL, and no special quoting is required since the database server handles that internally. It's much safer in that SQL injection becomes impossible at that point.
- warmwaffles 12y agoThat's not what OP was saying. That SQL string you just provided is static. At some point the ORM has to assemble that string.
- X-Istence 12y agoOP said: > Prepared statements with bind variables only work when the SQL string is static and only the variables change This is wrong.
- simonw 12y agoI said "All ORMs build at least some of their SQL using string concatenation" The "at least some" was meant to imply that they also use bind variables.
- deleted 12y ago[deleted]
- bensedat 12y agoLooks like the Rails 3.2 update drags along a few other unrelated changes, although they appear to be fairly minor: https://github.com/rails/rails/compare/v3.2.18...v3.2.19 https://github.com/rails/rails/compare/v3.2.18...v3.2.19 as compared to: https://github.com/rails/rails/compare/v4.1.2...v4.1.3 https://github.com/rails/rails/compare/v4.1.2...v4.1.3 and https://github.com/rails/rails/compare/v4.0.6...v4.0.7 https://github.com/rails/rails/compare/v4.0.6...v4.0.7
- jerhinesmith 12y agoYou'd have thought they'd stop doing that after the Github email embarrassment: https://github.com/blog/1440-github-enterprise-email-incident-today https://github.com/blog/1440-github-enterprise-email-inciden...
- bensedat 12y agoIf you're applying a patch manually to Rails 4.0/4.1, there was a regression and new versions have been issued: https://groups.google.com/forum/#!topic/rubyonrails-security/8GtfeYd6qI4 https://groups.google.com/forum/#!topic/rubyonrails-security...
- thibaut_barrere 12y agoI use this now to make sure I review before updating: https://gist.github.com/thbar/7dc97d3f5f6a52e4fa00 https://gist.github.com/thbar/7dc97d3f5f6a52e4fa00 (obviously not to be used in a CI environment). Also, if you want to make sure you get push notification for security updates, check out this: http://thibautbarrere.com/how-to-get-push-notifications-for-rails-ruby-security-updates/ http://thibautbarrere.com/how-to-get-push-notifications-for-... (I get only critical stuff as pushes, and get notified even in the rare case that the rails security email goes to spam as it happened once previously).
- craigkerstiens 12y agoYou should be able to see if you are vulnerable by running this query: select cn.nspname as schema, relname as table, attname as column, tn.nspname as type_schema, typname as type_name from pg_attribute a inner join pg_class c on a.attrelid = c.oid inner join pg_namespace cn on c.relnamespace = cn.oid inner join pg_type t on a.atttypid = t.oid inner join pg_namespace tn on t.typnamespace = tn.oid where (t.typtype = 'r' or t.typname = 'bit' or t.typname = 'varbit');
- jrmiii 12y agoFTA: Only applications which query against either bitstring or range types are vulnerable.
- Pacabel 12y agoIt's unfortunate that the wording of the email subject (and the current HN submission title) can make it sound like the problem is with PostgreSQL, when it's really a problem with Active Record's adapter for PostgreSQL. PostgreSQL itself isn't responsible or affected, contrary to what the "Vulnerabilities Affecting PostgreSQL" phrasing suggests at a glance.