Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
"Recent Rails SQL Issues" - 2012
Search
Justin Collins
April 23, 2015
Programming
0
69
"Recent Rails SQL Issues" - 2012
Justin Collins
April 23, 2015
Tweet
Share
More Decks by Justin Collins
See All by Justin Collins
Continuous (Application) Security at DevOps Velocity
presidentbeef
0
150
The Evolution of Rails Security
presidentbeef
1
810
Brakeman RailsConf 2017 Lightning Talk
presidentbeef
0
140
Practical Static Analysis for Continuous Application Security
presidentbeef
0
200
"...But Doesn't Rails Take Care of Security for Me?"
presidentbeef
1
440
Continuous Security with Practical Static Analysis
presidentbeef
1
320
Security Automation at Twitter - Rise of the Machines
presidentbeef
0
240
The World of Rails Security - RailsConf 2015
presidentbeef
8
1.2k
Tales from the Crypt
presidentbeef
1
240
Other Decks in Programming
See All in Programming
チームのテスト力を鍛える
goyoki
3
400
rage against annotate_predecessor
junk0612
0
170
CJK and Unicode From a PHP Committer
youkidearitai
PRO
0
110
Namespace and Its Future
tagomoris
6
700
Swift Updates - Learn Languages 2025
koher
2
490
アプリの "かわいい" を支えるアニメーションツールRiveについて
uetyo
0
270
RDoc meets YARD
okuramasafumi
4
170
テストカバレッジ100%を10年続けて得られた学びと品質
mottyzzz
2
600
そのAPI、誰のため? Androidライブラリ設計における利用者目線の実践テクニック
mkeeda
2
320
実用的なGOCACHEPROG実装をするために / golang.tokyo #40
mazrean
1
280
2025 年のコーディングエージェントの現在地とエンジニアの仕事の変化について
azukiazusa1
24
12k
私の後悔をAWS DMSで解決した話
hiramax
4
210
Featured
See All Featured
Context Engineering - Making Every Token Count
addyosmani
3
50
Documentation Writing (for coders)
carmenintech
74
5k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
52
5.6k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
49
3k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
367
27k
Unsuck your backbone
ammeep
671
58k
No one is an island. Learnings from fostering a developers community.
thoeni
21
3.4k
Become a Pro
speakerdeck
PRO
29
5.5k
Producing Creativity
orderedlist
PRO
347
40k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
How to train your dragon (web standard)
notwaldorf
96
6.2k
VelocityConf: Rendering Performance Case Studies
addyosmani
332
24k
Transcript
Rails Vulnerabilities Last Week CVE-2012-2660 CVE-2012-2661
CVE-2012-2660 Allows unexpected “IS NULL” in queries Affects Rails 2.x
and 3.x
ActiveRecord Query unless params[:name].nil? @user = User.where(:name => params[:name]) end
Query Parameters ?name[] {"name"=>[nil]}
ActiveRecord Query unless [nil].nil? @user = User.where(:name => [nil]) end
Resulting SQL SELECT "users".* FROM "users" WHERE "users"."name" IS NULL
CVE-2012-2661 Allows some manipulation of WHERE clause via “dotted” query
keys Affects Rails 3.x
ActiveRecord Query User.where(:name => params[:name])
ActiveRecord Query User.where("users.name" => params[:name])
Query Parameters ?name[users.id]=1 {"name"=>{"users.id"=>"1"}}
ActiveRecord Query User.where(:name => {"users.id" => "1"})
Resulting SQL SELECT "users".* FROM "users" WHERE "users"." id" =
1
Unreleased Vulnerability Allows some manipulation of WHERE clause via nested
hashes in query values Affects 2.3.x and 3.x
ActiveRecord Query User.where(:name => params[:name], :password => params[:password])
Query Parameters ?name[users][id]=1&password[users][id]=1 {"name"=>{"users"=>{"id"=>"1"}}, "password" =>{"users"=>{"id"=>"1"}}}
ActiveRecord Query User.where( :name => {"users"=>{"id"=>"1"}, :password => {"users"=>{"id"=>"1"} )
Resulting SQL SELECT "users".* FROM "users" WHERE "users"." id" =
1 AND "users"."id" = 1