ActiveRecord Vulnerability - Circumvention of attr_protected
groups.google.com
ActiveRecord Vulnerability - Circumvention of attr_protected
1–10 of 96 posts
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#2This one seems pretty amateur and should have been caught as part of a pull request/code review process.
- @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/
+ @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#3Shortly followed by two others:
https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... (Rails 2.3 and 3.0)
https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... (JSON library)
And in a short followup:
"To be clear, updating Rails doesn't necessarily mean the JSON gem will be updated. Please ensure that you are running JSON version 1.7.7, 1.6.8, or 1.5.5. You can do this by adding the dependency to your Gemfile." -- Aaron Patterson
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#4This one seems pretty amateur and should have been caught as part of a pull request/code review process. - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/ + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/ ^ and $ only match the first line in ruby, whereas \A and \z match across all lines.
More specifically, \A and \z are "start of string" and "end of string" respectively.
Why not \Z, you ask? \Z will match to the end of the string but ignore a trailing newline.
irb(main):001:0> !!("hello\n" =~ /\Ahello\z/)
=> false
irb(main):002:0> !!("hello\n" =~ /\Ahello\Z/)
=> trueRe: ActiveRecord Vulnerability - Circumvention of attr_protected
#5I don't use rails but it seems that the quality of releases have been going downhill over the pass months.
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#6This one seems pretty amateur and should have been caught as part of a pull request/code review process. - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/ + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/ ^ and $ only match the first line in ruby, whereas \A and \z match across all lines.
"This one seems pretty amateur and should have been caught as part of a pull request/code review process"
I say that about 95% of the bugs I ever see...especially ones written by me.
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#7Surely you should be using attr_accessible with config.active_record.whitelist_attributes = true anyway? I can't imagine a situation where you'd want to have to manually blacklist attributes over whitelisting them.
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#8Yikes, looks like my morning is shot now
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#9I don't use rails but it seems that the quality of releases have been going downhill over the pass months.
These vulnerabilities have been present for many years. They're just being found now. If anything, the quality is now going up. :)
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#10I don't use rails but it seems that the quality of releases have been going downhill over the pass months.
It's just that there has been a large amount of vulnerabilities found in the last month