Ruby on Rails Audit Complete
ostif.org
Ruby on Rails Audit Complete
1–10 of 171 posts
Re: Ruby on Rails Audit Complete
#2May be even better to link it to the PDF? [1]. From the Changelog I am also guessing most of these are not fixed in 8.0.2? I wonder if they will come with Rails 8.1 which is still not released.
[1] https://www.x41-dsec.de/static/reports/X41-Rails-Audit-Final...
Re: Ruby on Rails Audit Complete
#3Can they please do Django?
Re: Ruby on Rails Audit Complete
#4Thats good news! I'm a huge fan or Rails but a little surprised of such little vulnerabilities tbh. Would have expected more for such large codebase. But happy to hear it aint!
Re: Ruby on Rails Audit Complete
#5I settled for the Rails Way using a subset of the defaults. Not disappointed
Re: Ruby on Rails Audit Complete
#6May be even better to link it to the PDF? [1]. From the Changelog I am also guessing most of these are not fixed in 8.0.2? I wonder if they will come with Rails 8.1 which is still not released. [1] https://www.x41-dsec.de/static/reports/X41-Rails-Audit-Final...
You really dont want strict same site cookies for the most part. I get that its "more secure" but as soon as someone clicks a link from somewhere else, you open it without being logged in.
Re: Ruby on Rails Audit Complete
#7Can they please do Django?
You can pay for one.
Fast, cheap, good - pick two. Seems like a non-profit fund paid probably tens of thousands of dollars for this RoR audit. Can you raise the same amount to audit Django or convince a fund to spend money they already raised? If so, great!
Re: Ruby on Rails Audit Complete
#8Thats good news! I'm a huge fan or Rails but a little surprised of such little vulnerabilities tbh. Would have expected more for such large codebase. But happy to hear it aint!
I don't think it's meant to be a complete audit of the codebase, and in fact this is alluded to in the final report [0] (though the wording is strange—perhaps they forgot to update it from an earlier report):
> Due to the size of Ruby on Rails, it will not be possible to cover all the tests and tasks in the following test plan. The tests performed will be covered in the final report along with suggestions on what to focus on in future audits.
I feel like these sorts of audits are usually performed on individual applications rather than "mature" already widely used frameworks. I've got the sense that they are meant to give confidence that the developers knew what they were doing (since they focus on typical vulnerabilities that good developers should know about), rather than proving anything about the code base. Still better than nothing.
[0] Section 3.7, https://ostif.org/wp-content/uploads/2025/06/X41-Rails-Audit...
Re: Ruby on Rails Audit Complete
#9> Rails application server (e.g., Puma, Unicorn)
I think it's more appropriate to call those Rack application servers, Rack being the Ruby CGI Rails implements.
It's a minor nitpick.
Re: Ruby on Rails Audit Complete
#10Thats good news! I'm a huge fan or Rails but a little surprised of such little vulnerabilities tbh. Would have expected more for such large codebase. But happy to hear it aint!
I don't think it's meant to be a complete audit of the codebase, and in fact this is alluded to in the final report [0] (though the wording is strange—perhaps they forgot to update it from an earlier report): > Due to the size of Ruby on Rails, it will not be possible to cover all the tests and tasks in the following test plan. The tests performed will be covered in the final report along with suggestions on what to…
Thank you for clearing this up!