SQL Injection Vulnerability in Ruby on Rails; affects all versions

michaelfairley wrote: post #3

This affects all versions of Rails, not just 3.x. This is a really, really bad hole, and you should patch or upgrade ASAP.

Thanks, fixed the headline. All versions are affected, only 3.1, 3.2 have official support

Re: SQL Injection Vulnerability in Ruby on Rails; affects all versions

#5

Post by jtchang » Wed, Jan 02, 2013, 9:58 PM UTC

I am mostly a Django programmer so excuse my ignorance of rails. How does this keep happening?

In Django you would do:

Post.objects.get(pk=request.GET['id'])

There really is no way to do SQL injection this way.

This line in rails looks almost exactly like how you would do it in Django:

Post.find_by_id(params[:id])

Also this seems really serious. It's not like a edge case where you need to grab a post by id. This is probably a very common use case of that method find_by_id.

Re: SQL Injection Vulnerability in Ruby on Rails; affects all versions

#6

Post by zacksjoden » Wed, Jan 02, 2013, 10:01 PM UTC

For someone just learning RoR and having installed it via http://railsinstaller.org/, how should I upgrade?

Re: SQL Injection Vulnerability in Ruby on Rails; affects all versions

#7

Post by cheald » Wed, Jan 02, 2013, 10:05 PM UTC

zacksjoden wrote: post #6

For someone just learning RoR and having installed it via http://railsinstaller.org/ , how should I upgrade?

Run "bundle update rails" in your project's root directory (where your Gemfile is).

Re: SQL Injection Vulnerability in Ruby on Rails; affects all versions

#8

Post by codewright » Wed, Jan 02, 2013, 10:06 PM UTC

jtchang wrote: post #5

I am mostly a Django programmer so excuse my ignorance of rails. How does this keep happening? In Django you would do: Post.objects.get(pk=request.GET['id']) There really is no way to do SQL injection this way. This line in rails looks almost exactly like how you would do it in Django: Post.find_by_id(params[:id]) Also this seems really serious. It's not like a edge case where you need to grab a post by id. This is p…

Btw, this applies for my (Python) Flask apps using MongoDB ORMs. They escape the inputs.

What the hell is going on with ActiveRecord?

Re: SQL Injection Vulnerability in Ruby on Rails; affects all versions

#9

Post by danso » Wed, Jan 02, 2013, 10:06 PM UTC

zacksjoden wrote: post #6

For someone just learning RoR and having installed it via http://railsinstaller.org/ , how should I upgrade?

It should be as easy as 'gem update rails' at your command line (Terminal window).

If you're just learning and creating an app for your own edification, this is not really an issue that will affect you. That is, it doesn't affect how you construct the app, so if for some reason the gem update process doesn't work, you won't be hindered from using RoR.

Re: SQL Injection Vulnerability in Ruby on Rails; affects all versions

#10

Post by thelarry » Wed, Jan 02, 2013, 10:06 PM UTC

Im not a RoR developer, so forgive my ignorance. But how does this keep happening? I thought ActiveRecord is a mature product by now. I hear about these types of bugs happening with RoR pretty often, is the "magic" of ActiveRecord and hiding SQL from the developer really worth it? I wonder how many RoR developers even understand what SQL injection actually means.