61–70 of 96 posts
Earlier quoted context omitted.
It didn't take much "ear to the ground" to tell that a lot of people had started very carefully sifting through Rails code.
The idea for his post was nothing special, but the post itself was very well written and deserves a lot of credit.
Earlier quoted context omitted.
I have 170 tables in an app and a similar amount of controllers. 3 of those refer to the logged in user and in no place except the admin controller itself can you modify an object, or what an object refer to, in such a way where an administrator can access anything he or she shouldn't. Admins have different accounts not to restrict what they can do but to (automatically outside what can be modified by posting params…
This is ostensibly why attr_accessible has a "role" parameter.
This one seems pretty amateur and should have been caught as part of a pull request/code review process. - @regex = /^(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})$/ + @regex = /\A(#{Regexp.escape(@prefix)})(.+?)(#{Regexp.escape(@suffix)})\z/ ^ and $ only match the first line in ruby, whereas \A and \z match across all lines.
I feel a bit dumb, but I never would have thought about this one. So, is this best practice for any kind of validation regex?
In general, you may be better off avoiding regexes when you can, especially if it's security-sensitive. They're very useful, but they're very easy to get wrong, especially when they get complex. This case, for instance, looks like it would have been impossible if they checked if the attribute were in a list, instead of building a regex. It might be faster with a regex in this case, but for most people that's a (massively) premature optimization for (imperceptibly) small gain.
Shameless self promotion: we're working on something to make dealing with these patches less painful. It's not out yet, but soon: http://gemcanary.com
xcanary would be better... e.g. alerts on mysql, django, ubuntu... anything :)
I don't use rails but it seems that the quality of releases have been going downhill over the pass months.
The quality was always terrible, these are ancient bugs that are just being noticed now. Rails is designed with a 'convenience first, then use a couple regexes to "secure" it' mentality. Any software designed like that will be full of these sorts of holes.
I suggest that you follow the advice, "if you can't think of anything nice or constructive to say, bite your tongue". The irony is not lost on me that in taking you to task for the tone you couch your comments in I am failing to live up to my own advice, but I'll make an exception here.
I want to shamelessly give a shout-out to Ryan from our MTV team on this one; Rails ActiveModel was I think? the first real piece of Ruby code he ever looked at, and he found the permset Blacklist regex bypass (joernchen found the other one) inside of an hour. Everyone here will testify that I was no help to him at all; my contributions mostly consisted of throwing a large rubber balancing ball at him from the other…
Earlier quoted context omitted.
This is an extremely common bug that is not specific to Rails. It would be worth reviewing your code to look at every regex to see if you have similar flaws.
I seem to remember a blog post about this regex issue here on HN a few months ago. It definitely surprised me to learn that Ruby doesn't treat $ as end-of-string by default.
Shameless self promotion: we're working on something to make dealing with these patches less painful. It's not out yet, but soon: http://gemcanary.com