5 ms·
Rails has ActiveSupport::SafeBuffer for doing XSS protection, but ruby doesn't track external strings as dirty like that.
by JonnieCache 11y ago
Rails has ActiveSupport::SafeBuffer for doing XSS protection, but ruby doesn't track external strings as dirty like that.
- flgr 11y ago> but ruby doesn't track external strings as dirty like that. It does: irb(main):001:0> gets.tainted? foo => true You can even set $SAFE to 1 or higher to disallow the use of tainted strings in potentially dangerous commands: freya:~ flgr$ ruby -e '$SAFE = 1; system "tar bla bla #{gets}"' foo -e:1:in `system': Insecure operation: -r (SecurityError) from -e:1:in `<main>' See http://phrogz.net/programmingruby/taint.html http://phrogz.net/programmingruby/taint.html for more information.
- vidarh 11y ago> but ruby doesn't track external strings as dirty like that. Yes, it does. E.g: x = STDIN.gets puts x.tainted? y = "hello "+x puts y.tainted? z = "foo" puts z.tainted? The two first will return "true", and the last will print "false". If you set the safe-level appropriately some methods will be disallowed for x and y above (e.g. eval()), though I would not trust that as comprehensive, but it's a lot better than nothing.