Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ActiveRecord Vulnerability - Circumvention of attr_protected

groups.google.com

Post reply on HN
Print view View original

21–30 of 96 posts

Re: ActiveRecord Vulnerability - Circumvention of attr_protected

#21

Post by daviding »

steveklabnik wrote: post #18
daviding wrote: post #15

Given that there is no 3.0.X update this time, where's a good resource to learn about applying the manual patch?

I have a blog post here: http://blog.steveklabnik.com/posts/2012-10-04-run-rails-with...

Thank you. Also, info about git patch rather than a git cherrypick, in-case it's useful to anyone:

https://ariejan.net/2009/10/26/how-to-create-and-apply-a-pat...

Re: ActiveRecord Vulnerability - Circumvention of attr_protected

#23

Post by sikachu_ »

daviding wrote: post #15

Given that there is no 3.0.X update this time, where's a good resource to learn about applying the manual patch?

If you're using Bundler (which I assume you do, for Rails 3.0) tl;dr is changing from:

    gem 'rails', '3.0.20'
to

    gem 'rails', github: 'rails/rails', branch: '3-0-stable'

Re: ActiveRecord Vulnerability - Circumvention of attr_protected

#24

Post by phillmv »

colinhowe wrote: post #22
phillmv wrote: post #17

Shameless self promotion: we're working on something to make dealing with these patches less painful. It's not out yet, but soon: http://gemcanary.com

xcanary would be better... e.g. alerts on mysql, django, ubuntu... anything :)

One step at a time! We're going to start with bundler-enabled applications, but I see no reason why it couldn't be expanded to other communities.

Re: ActiveRecord Vulnerability - Circumvention of attr_protected

#25

Post by steveklabnik »

sikachu_ wrote: post #23
daviding wrote: post #15

Given that there is no 3.0.X update this time, where's a good resource to learn about applying the manual patch?

If you're using Bundler (which I assume you do, for Rails 3.0) tl;dr is changing from: gem 'rails', '3.0.20' to gem 'rails', github: 'rails/rails', branch: '3-0-stable'

This is slightly different: this will mean you're bundling the stable branch, which may or may not be the same as 'the last release plus a single security patch.'

Re: ActiveRecord Vulnerability - Circumvention of attr_protected

#26

Post by tptacek »

sync wrote: post #2

This one seems pretty amateur and should have been caught as part of a pull request/code review process. - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/ + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/ ^ and $ only match the first line in ruby, whereas \A and \z match across all lines.

This is an extremely common bug that is not specific to Rails. It would be worth reviewing your code to look at every regex to see if you have similar flaws.

Re: ActiveRecord Vulnerability - Circumvention of attr_protected

#27

Post by bdcravens »

Tomdarkness wrote: post #7

Surely you should be using attr_accessible with config.active_record.whitelist_attributes = true anyway? I can't imagine a situation where you'd want to have to manually blacklist attributes over whitelisting them.

That's made learning Rails a bit interesting. Seems that a number of these vulnerabilities are practically moot if you're following best practices brought about within the last year or so (for example, attr_accessible on all models as a result of the Github snafu). Of course, all vulnerabilities are worth paying attention to, but it'd be nice to know which ones are relevant to greenfield development.

Re: ActiveRecord Vulnerability - Circumvention of attr_protected

#30

Post by eksith »

kclay wrote: post #5

I don't use rails but it seems that the quality of releases have been going downhill over the pass months.

I'm not a Rails dev so this doesn't affect me, but from a software standpoint, discovering vulnerabilities is a good thing in the longer run.

These are not new vulnerabilities, but are being discovered now, which means more spotlights are shining on the project. That's a sign of maturity too. From a maintenance standpoint, it will be a pain to apply patches to older software and those seeing heavy use, but it will cause some reexamination of existing code and practices.

There will be a domino effect of more eyes focusing on the code now, which in turn will lead to more discoveries of course, but hopefully, new fixes too.

Post reply on HN