81–90 of 96 posts
Earlier quoted context omitted.
that's why I asked. I know attribute_assignment.rb code pretty well - no strip is called. So conclusion: this doesn't lead to mass assignment. only DoS.
i can't actually explain why it works but it does work. I think it is result of both of the buggy regular expressions.
Earlier quoted context omitted.
The quality was always terrible, these are ancient bugs that are just being noticed now. Rails is designed with a 'convenience first, then use a couple regexes to "secure" it' mentality. Any software designed like that will be full of these sorts of holes.
I've spent the last 10 minutes reading your comment history. You come across as an opinionated argumentative snide jerk. Note: before you take my comment apart and feed it back to me realize that I have no desire in getting into a verbal sparring match with you and won't reply to you. I suggest that you follow the advice, "if you can't think of anything nice or constructive to say, bite your tongue". The irony is not…
So it's basically a training system to encourage people to comment like this (remember; you need 500+ karma to down vote, so for many people, you can only ignore or up vote; therefore, all you see for a post is upvotes).
:/
Earlier quoted context omitted.
I've spent the last 10 minutes reading your comment history. You come across as an opinionated argumentative snide jerk. Note: before you take my comment apart and feed it back to me realize that I have no desire in getting into a verbal sparring match with you and won't reply to you. I suggest that you follow the advice, "if you can't think of anything nice or constructive to say, bite your tongue". The irony is not…
http://en.wikipedia.org/wiki/Ad_hominem
Earlier quoted context omitted.
http://en.wikipedia.org/wiki/Ad_hominem
Indeed, but not quite. Ask yourself if it was my intent to counter the person's claims by attacking the person. No, that was not my intent. I never intended to counter the person's claims. I was explicitly calling the person out based on tone and style of his/her comment and others in his/her comment history. The thought even crossed my mind while carefully drafting the above comment that I ought to preempt the accus…
Earlier quoted context omitted.
The quality was always terrible, these are ancient bugs that are just being noticed now. Rails is designed with a 'convenience first, then use a couple regexes to "secure" it' mentality. Any software designed like that will be full of these sorts of holes.
I've spent the last 10 minutes reading your comment history. You come across as an opinionated argumentative snide jerk. Note: before you take my comment apart and feed it back to me realize that I have no desire in getting into a verbal sparring match with you and won't reply to you. I suggest that you follow the advice, "if you can't think of anything nice or constructive to say, bite your tongue". The irony is not…
Given that there is no 3.0.X update this time, where's a good resource to learn about applying the manual patch?
Earlier quoted context omitted.
One of the core issues here was a serialization library that was too convenient, with the ability to deserialize into arbitrary classes and end up executing code from them. In the Python world, this vulnerability has been a bit better known for a while (which is not to say that they are immune, but it's at least been common community knowledge for a very long time now, at least a decade). Pickle is well-known to have…
AFAIK, the only way this could be an issue with the language is if you use serialize/unserialize, which can be used on classes. It goes without saying that this can be useful in certain contexts - such as file-based caching - but should not be relied upon too heavily. I cannot remember the last time I came across a php project that did something similar.
Right from the Github mass-assignment [1] vulnerability to the recent YAML & JSON parsing vulnerabilities, it's the same core concept being violated.
This gets me thinking -- is Rails the right choice for a large project with JSON, XML, & regular HTML endpoints?
PS: I'm not sure what the code-review policy for Rails is, but now would be the time to call-out people who wrote this bad code and NOT auto-merge their future commits without at least two peer reviews.
Earlier quoted context omitted.
Also a good time to remind people to subscribe to the security mailing list: https://groups.google.com/forum/#!forum/rubyonrails-security
We have new emails to rubyonrails-security triggering PagerDuty alarms as well.