Any popular Rails apps that use to_global_id?
Be Careful with GIDs in Rails
11–20 of 22 posts
Re: Be Careful with GIDs in Rails
#12If you don't want invoice 22 to be shown by someone putting 22 on the url, you definetly need to enforce permissions on your app. The Global ID issue is tangential to that.
Re: Be Careful with GIDs in Rails
#13So....LLMs can hallucinate GIDs. I hope that everyone is aware of that.
Re: Be Careful with GIDs in Rails
#14Any popular Rails apps that use to_global_id?
Almost any modern rails apps that have a job queue will use this at some point
Re: Be Careful with GIDs in Rails
#15> GIDs are not checked for authorization when doing the lookup - they are meant to be generated above the authorization layer, and to be consumed above the authorization layer Then the problem with this post boils down to applying the authorization layer in any tool call, just like you do in controllers. Seems obvious?
Agreed. Seems like the author tried to get fancy using GIDs with LLMs to cut down on the logic in their tool calls and opened a can of worms.
Re: Be Careful with GIDs in Rails
#16This title is odd, given the actual identified problem seems to be LLMs writing code.
[deleted]
Re: Be Careful with GIDs in Rails
#17If you don't want invoice 22 to be shown by someone putting 22 on the url, you definetly need to enforce permissions on your app. The Global ID issue is tangential to that.
Sure but the real concern of the article that if passed "gid://moneymaker/Invoice/22ecb3fd-5e25-462c-ad2b-cafed9435d16" the global id locator will effectively locate "gid://moneymaker/Invoice/22". Which is to say, that what is supposed to be a system-generated id which has no need for de-slugification, uses the same lookup method as is normally used for URLs which attempts to de-slugify.
Obviously, this means that first gid was bogus anyway, as it was trying to look up via the wrong key, but the fact that it doesn't fail, and will instead return the record with primary key "22" can certainly be surprising.
Re: Be Careful with GIDs in Rails
#18I struggle to understand what this specifically has to do with rails or global IDs. In ANY framework or query system, if you are asking an LLM to produce IDs which you are then passing to a database for lookup, you need to understand those identifiers could be hallucinated or incorrect in surprising or malicious ways, and can lead to data leaks or exfiltration.
It's like writing an article about "the dangers of PostgreSQL" ... when generating SQL from an LLM. It has nothing to do with Postgres specifically, it's that you're generating queries to run in a trusted context from an untrustable origin.
Re: Be Careful with GIDs in Rails
#19Rails is a dangerous place to be throwing random data into APIs.
Also all the other places are too.
Re: Be Careful with GIDs in Rails
#20Or more like "be careful with the power you give your LLMs"