Writing Secure(r) Rails Apps

Three quick rules to keep in mind to ensure your Rails apps are just a little bit more secure.

Transcript

1. Sunday, September 15, 13
2. Secure Rails Apps r Sunday, September 15, 13
3. https://www.owasp.org/index.php/Top_10_2013-Top_10 Sunday, September 15, 13
4. DON’T TRUST USERS RULE #1 Sunday, September 15, 13
5. Author.where("publisher_name = #{params[:publisher_name]}") SQL Injection Sunday, September 15, 13
6. Author.where(publisher_name: params[:publisher_name]) Better Example Sunday, September 15, 13
7. Author.where("publisher_name LIKE ?", "%#{params[:publisher_name]}%") Better Example Sunday, September 15, 13
8. `ghostscript #{params[:user_filename]}` Shell Injection Sunday, September 15, 13
9. file = params[:user_filename].shellescape `ghostscript #{file}` Better Example Sunday, September 15, 13
10. "<b>Updated display name: #{@user.name}</b>".html_safe Cross-Site Scripting Sunday, September 15, 13
11. In Review User input is dangerous. Even after it’s saved to the database! Sunday, September 15, 13
12. RULE #2 LOCK DOWN SENSITIVE DATA Sunday, September 15, 13
13. before_filter :require_admin private def require_admin unless current_user.admin? flash[:error] = "You must be logged in to access this section" redirect_to root_url end end Sunday, September 15, 13
14. CanCan ryanb/cancan Sunday, September 15, 13
15. class Ability include CanCan::Ability def initialize user can :read, Post, account_id: user.account_id end end Sunday, September 15, 13
16. class PostsController < ApplicationController load_and_authorize_resource # ... end Sunday, September 15, 13
17. <option value="120">Alan <option value="121">Bria Sunday, September 15, 13
18. <option value="a45b121"> <option value="7e659aa"> Stop Using Database IDs Sunday, September 15, 13
19. Sunday, September 15, 13
20. Sunday, September 15, 13
21. In Review Restrict what users can access Validate incoming data Keep your secrets secret Sunday, September 15, 13
22. RULE #3 KEEP STUFF UP-TO-DATE! Sunday, September 15, 13
23. Sunday, September 15, 13
24. Rails ruby interpreter database adapter authentication view templates javascript Sunday, September 15, 13
25. Sunday, September 15, 13
26. YOU! https://groups.google.com/forum/#! forum/rubyonrails-security https://www.ruby-lang.org/en/ security/ http://guides.rubyonrails.org/ security.html Sunday, September 15, 13
27. In Review Keep gems up-to-date Keep learning Sunday, September 15, 13
28. Sunday, September 15, 13