Surely you should be using attr_accessible with config.active_record.whitelist_attributes = true anyway? I can't imagine a situation where you'd want to have to manually blacklist attributes over whitelisting them.
Legacy codebases, etc etc
ActiveRecord Vulnerability - Circumvention of attr_protected
11–20 of 96 posts
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#12Patio11 is indeed the security soothsayer
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#13what is bypass?
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#14I don't use rails but it seems that the quality of releases have been going downhill over the pass months.
Most of the vulnerabilities you (likely) have been seeing are from code that's been a part of rails for a lot longer than the past few months.
The spate of recent vulnerabilities has more to do with YAML in particular than with rails itself.
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#15Given that there is no 3.0.X update this time, where's a good resource to learn about applying the manual patch?
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#16Shortly followed by two others: https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... (Rails 2.3 and 3.0) https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... (JSON library) And in a short followup: "To be clear, updating Rails doesn't necessarily mean the JSON gem will be updated. Please ensure that you are running JSON version 1.7.7, 1.6.8, or 1.5.5. You can do this by adding the dependency to…
Also a good time to remind people to subscribe to the security mailing list:
https://groups.google.com/forum/#!forum/rubyonrails-security
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#17Shameless self promotion: we're working on something to make dealing with these patches less painful.
It's not out yet, but soon: http://gemcanary.com
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#18Given that there is no 3.0.X update this time, where's a good resource to learn about applying the manual patch?
I have a blog post here: http://blog.steveklabnik.com/posts/2012-10-04-run-rails-with...
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#19Surely you should be using attr_accessible with config.active_record.whitelist_attributes = true anyway? I can't imagine a situation where you'd want to have to manually blacklist attributes over whitelisting them.
We definitely think you should be using attr_accessible and not attr_protected.
Re: ActiveRecord Vulnerability - Circumvention of attr_protected
#20I want to shamelessly give a shout-out to Ryan from our MTV team on this one; Rails ActiveModel was I think? the first real piece of Ruby code he ever looked at, and he found the permset Blacklist regex bypass (joernchen found the other one) inside of an hour. Everyone here will testify that I was no help to him at all; my contributions mostly consisted of throwing a large rubber balancing ball at him from the other side of the office.
Finding people like Ryan to work with--- "sleepers" who don't have long track records of filing public vulnerabilities, but who are secretly terrifying killing machines --- is the single best thing about my job.
Ryan found us on HN after beating the Stripe CTF. If you're like Ryan, ping me; I will go out of my way to make sure we tell you everything we can about why you should work with us.
Back on topic: if I was going to place a bet on something about Rails security, it'd be that there are more regex vulnerabilities in the tree. I am uncomfortable with how much Rails leans on regex for policy decisions.
Finally, said this before, saying it again: if you have a Rails app with customers, you need to be following @joernchen on Twitter full stop.