31–40 of 96 posts
This one seems pretty amateur and should have been caught as part of a pull request/code review process. - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/ + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/ ^ and $ only match the first line in ruby, whereas \A and \z match across all lines.
If I'm not using AR (mongoid instead) and I don't have any explicit JSON.parse in my code, am I OK?
https://rubyonrails-security.googlegroups.com/attach/bb44b98...
Is stuff like this vulnerability present in Django as well, and just not being discovered as quickly, or is there something in the water (or was there years ago) in the Rails camp that caused all these bugs?
It's certainly possible. Maybe, maybe not.
The recent spate of Rails vulnerabilities - the really scary ones at least - all stemmed from the same root cause: folks were a little too lenient with how they handled YAML parsing.
Once that was discovered, a lot more attention has been directed to how Rails handles different kinds of parsing.
It's possible! that other frameworks have had similar cascading mistakes, but we won't know until more code reviews occur. Maybe in this particular case Rails-core was especially lenient, but (as far as I remember) dedicated security people have only taken a keener interest in the past year or so.
Shortly followed by two others: https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... (Rails 2.3 and 3.0) https://groups.google.com/forum/?fromgroups=#!topic/rubyonra... (JSON library) And in a short followup: "To be clear, updating Rails doesn't necessarily mean the JSON gem will be updated. Please ensure that you are running JSON version 1.7.7, 1.6.8, or 1.5.5. You can do this by adding the dependency to…
Also a good time to remind people to subscribe to the security mailing list: https://groups.google.com/forum/#!forum/rubyonrails-security
This one seems pretty amateur and should have been caught as part of a pull request/code review process. - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/ + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/ ^ and $ only match the first line in ruby, whereas \A and \z match across all lines.
Is stuff like this vulnerability present in Django as well, and just not being discovered as quickly, or is there something in the water (or was there years ago) in the Rails camp that caused all these bugs?
I want to shamelessly give a shout-out to Ryan from our MTV team on this one; Rails ActiveModel was I think? the first real piece of Ruby code he ever looked at, and he found the permset Blacklist regex bypass (joernchen found the other one) inside of an hour. Everyone here will testify that I was no help to him at all; my contributions mostly consisted of throwing a large rubber balancing ball at him from the other…
This one seems pretty amateur and should have been caught as part of a pull request/code review process. - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/ + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/ ^ and $ only match the first line in ruby, whereas \A and \z match across all lines.
This is an extremely common bug that is not specific to Rails. It would be worth reviewing your code to look at every regex to see if you have similar flaws.
Shameless self promotion: we're working on something to make dealing with these patches less painful. It's not out yet, but soon: http://gemcanary.com
Is stuff like this vulnerability present in Django as well, and just not being discovered as quickly, or is there something in the water (or was there years ago) in the Rails camp that caused all these bugs?