91–100 of 294 posts
I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!
Upgrade instructions: update your Gemfile and set the version you want. In my case: gem 'rails', '3.2.10' locally, run 'bundle update rails' which will update your Gemfile.lock check-in and deploy your code. If you are using capistranso, the default 'deploy' task should handle everything for you. Otherwise, run 'bundle update rails' on your production server.
I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!
Getting continuous errors on deploy during the bundle stage like so: /usr/lib/ruby/1.9.1/rubygems/remote_fetcher.rb:215:in `fetch_http': bad response Not Found 404 (http://bb-m.rubygems.org/quick/Marshal.4.8/activesupport-3.2.11.gemspec.rz) Is this because rubygems.org is being nailed?
I hope in consequence of this incident the Rails-team will build in an automatic security-update notification mechanism. I'd like my apps to poll rails.org (or whatever) every few minutes and by default shutdown hard when an incident like this is announced.
As a newcomer to the Rails ecosystem all these posts of vunlerabilities and open doors leaves a bad taste in my mouth. God know I love programming in Ruby now, but is Rails really that insecure?
Who'd have thought it? Hugely dynamic language turns out to be difficult to audit or analyse for security issues. It was never about Java(C, C++) vs. Ruby despite what fanboys on either side made out. It was about conservative vs. devil-may-care. All that "convenience" and "it's so clean" came at the price of a whole load of code executed behind the scenes. You didn't write it, and the Gods of TDD preached that you d…
http://websec.wordpress.com/2012/01/04/multiple-vulnerabilit...
I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!
Thanks!
Earlier quoted context omitted.
> As a simple solution, one could pass a signed auth-hash of the fields generated by form_for, and the server could re-hash the fields submitted to ensure the form data you asked for is what you get (this solves the primary issue with attr_accessible). It does not solve the issue of javascript generated forms.
Sure, but as with all things, it could be turned off. The more I think about it, the more I like this idea. I may as well try it out and mock up a pull request.
The only way to fix this by "more of a focus on security" would have been not to do clever things with parameters in the first place, but the clever things provide a lot of value, so the next best thing is security auditing and be on top of patching any vulnerabilities.
Upgrade instructions: update your Gemfile and set the version you want. In my case: gem 'rails', '3.2.10' locally, run 'bundle update rails' which will update your Gemfile.lock check-in and deploy your code. If you are using capistranso, the default 'deploy' task should handle everything for you. Otherwise, run 'bundle update rails' on your production server.
Earlier quoted context omitted.
> why isn't there more of a focus on security here? More compared to what, exactly? This vulnerability was responded to pretty damn quickly after it was reported, given that almost nobody is even paid to work on Rails. If you saw Aaron tweeting about "working over the weekend" a few days ago, well, now you know. That said, you mention attr_accessible in your post: that's gone as of the next release of Rails. Basicall…
If you've recently started a new Rails project (or are thinking about it), you should use strong_parameters right off the bat!
Rails noob here... with this and the other vulnerability from a few days ago, do all you need to do is update your rails gem to become safe? Current version at time of my post is 3.2.11, if I'm using that am I safe or do I need to perform additional steps?
Versions Affected: ALL versions Not affected: NONE Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15