Chao Add chao as a contact

“Try out coolchaser.com!”

Chao's Tags

RSS feed for this page

Chao's clips tagged security

Expand all

Another DoS Vulnerability in CGI Library

http://www.ruby-lang.org/en/news/2006/12/04/ano...

clipped by chao Dec 05, 2006

security

develop a ruby on rails web app

Hide Clip

Show Clip

Another DoS Vulnerability in CGI Library

Another vulnerability has been discovered in the CGI library (cgi.rb) that ships with Ruby which could be used by a malicious user to create a denial of service attack (DoS).

This vulnerability is open to the public as JVN#84798830.

Please note that the previous patch (<URL:http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-cgi-dos-1.patch>) does not fix this problem.

Impact

A specific HTTP request for any web application using cgi.rb causes CPU consumption on the machine on which the web application is running. Many such requests result in a denial of service.

Vulnerable versions

1.8 series

1.8.5 and all prior versions

Development version (1.9 series)

All versions before 2006-12-04

Solution

1.8 series

Please upgrade to 1.8.5-p2.

<URL:http://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p2.tar.gz> (4519151 bytes, md5sum: a3517a224716f79b14196adda3e88057)

Please note that a package that corrects this weakness may already be available through your package management software.
Loading...
- Add comments
- Copy this clip
Riding Rails: Rails 1.1.5: Mandatory security patch (and more)

http://blog.rubyonrails.org/2006/8/9/rails-1-1-...

clipped by chao Aug 10, 2006

security

develop a ruby on rails web app

Hide Clip

Show Clip

Rails 1.1.5: Mandatory security patch (and more)

Posted by David August 09, 2006 @ 05:30 PM

We’re still hard at work on Rails 1.2, which features all the new dandy REST stuff and more, but a serious security concern has come to our attention that needed to be addressed sooner than the release of 1.2 would allow. So here’s Rails 1.1.5!

This is a MANDATORY upgrade for anyone not running on a very recent edge (which isn’t affected by this). If you have a public Rails site, you MUST upgrade to Rails 1.1.5. The security issue is severe and you do not want to be caught unpatched.

The issue is in fact of such a criticality that we’re not going to dig into the specifics. No need to arm would-be assalients.

So upgrade today, not tomorrow. We’ve made sure that Rails 1.1.5 is fully drop-in compatible with 1.1.4. It only includes a handful of bug fixes and no new features.

For the third time: This is not like “sure, I should be flossing my teeth”. This is “yes, I will wear my helmet as I try to go 100mph on a motorcycle through downtown in rush hour”. It’s not a suggestion, it’s a prescription. So get to it!

As always, the trick is to do “gem install rails” and then either changing config/environment.rb, if you’re bound to gems, or do “rake rails:freeze:gems” if you’re freezing gems in vendor.
Loading...
- Add comments
- Copy this clip
SQL escaping and injection

http://railsmanual.org/class/ActiveRecord::Base

clipped by chao Mar 08, 2006

security

develop a ruby on rails web app

Hide Clip

Show Clip
Conditions can either be specified as a string or an array representing the WHERE-part of an SQL statement. The array form is to be used when the condition input is tainted and requires sanitization. The string form can be used for statements that don’t involve tainted data. Examples:

User < ActiveRecord::Base def self.authenticate_unsafely(user_name, password) find(:first, :conditions => "user_name = '#{user_name}' AND password = '#{password}'") end def self.authenticate_safely(user_name, password) find(:first, :conditions => [ "user_name = ? AND password = ?", user_name, password ]) end end

The authenticate_unsafely method inserts the parameters directly into the query and is thus susceptible to SQL-injection attacks if the user_name and password parameters come directly from a HTTP request. The authenticate_safely method, on the other hand, will sanitize the user_name and password before inserting them in the query, which will ensure that an attacker can’t escape the query and fake the login (or worse).
Loading...
- Add comments
- Copy this clip
JavaScript Entities

http://members.ozemail.com.au/~phoenix1/html/ge...

clipped by chao Nov 16, 2005

javascript security xss

use ajax in my web apps

Hide Clip

Show Clip
Using JavaScript expressions as HTML attribute values
Using JavaScript entities, you can specify a JavaScript expression as the value for an HTML attribute. Entity values are evaluated dynamically. This allows you to create more flexible HTML constructs, because the attributes of one HTML element can depend on information about elements placed previously on the page.
You may already be familiar with HTML character entities by which you can define characters with special numerical codes or names by preceding the name with an ampersand (&) and terminating it with a semicolon (;). For example, you can include a greater-than symbol (>) with the character entity &GT; and a less-than symbol (<) with &LT;.
JavaScript entities also start with an ampersand (&) and end with a semicolon (;). Instead of a name or number, you use a JavaScript expression enclosed in curly braces {}. You can use JavaScript entities only where an HTML attribute value would normally go. For example, suppose you define a variable barWidth. You could create a horizontal rule with the specified percentage width as follows:

<HR WIDTH="&{barWidth};%" ALIGN="LEFT">
So, for example, if barWidth were 50, this would create the following display:

As with other HTML, after layout has occurred, the display of a page can change only if you reload the page.
Unlike regular entities which can appear anywhere in the HTML text flow, JavaScript entities will be interpreted only on the right-hand side of HTML attribute name/value pairs. For example, <H4>&{myTitle};</H4> would display myTitle rather than the value of the variable myTitle.
Loading...
- 2 comments
- Copy this clip

Chao Add chao as a contact

Chao's Tags

Chao's clips tagged security

Another DoS Vulnerability in CGI Library

Rails 1.1.5: Mandatory security patch (and more)