Is your Rails application safe?

http://railspikes.com/2008/9/22/is-your-rails-application-safe-from-mass-assignment

by jon_dahl • 18 years ago

56 33 18 years ago

I never even knew about attr_protected / attr_accessible until I saw them being used in acts_as_authenticated.

Come to think of it, I learned a lot of good practices from AAA (and restful_authentication). attr_protected, salted/hashed passwords, and several other nifty tricks.

tptacek10• 18 years ago

This is one of the major security design flaws in Rails, and this is a good article on the problem. What's worse is that the correct design is "folk wisdom" in the community (for instance, a 37Signals dev is never going to make this mistake), but the best-known Rails sample code is all vulnerable.

Every other web stack has this problem in one form or another; for instance, in J2EE, which is either the first or second best-secured web stack out there, you can bypass the best-known best-documented access controls by changing your HTTP verb from "GET" to "SUPERGET", "GETX", or "GIMME".

But Rails kind of went out of its way to win this particular vulnerability, and so now it's something you have to audit for on every project.

100k6• 18 years ago

The other security design flaw of Rails that drives me nuts is that it is vulnerable to XSS attacks by default because it takes positive action to strip HTML from user input.

I believe that security should be the default, automatic choice, and you should have to take an affirmative step to disable that when you need to.

Rails does get a lot right with automatic cross-site request forgery protection and nearly automatic SQL injection protection but the lack of automatic HTML stripping and the default accessible attributes thing makes me sad.

tptacek10• 18 years ago

Rails is no more vulnerable to XSS than any other web stack; I pay for my dev team by looking at apps all day, and they all have this problem.

You're right that taking positive action to neutralize metacharacters is a weak design. There is a setting in Rails, IIRC, that automatically h() filters outputs, but it should be the default. Just as importantly, though, even if h() is the default, you still have to audit all the places where you deliberately allow HTML output, and every app has to do that somewhere.

I'm not disagreeing with you, but I am saying that there's a major difference between mass-assignment, which is a problem Rails seems to have blundered into, and XSS, which is endemic to web apps.

simonw4• 18 years ago

I'm very skeptical about the value of stripping HTML from user input - what if your site is a forum where people discuss HTML? Or a site where people might want to talk about the <head> conference? http://www.headconference.com/

Stripping HTML on input also means you lose the ability to audit attempted attacks against your site.

A much smarter strategy in my opinion is to escape everything on output. That way it doesn't matter what people submit to your site - unless you explicitly say "this is safe to display unescaped" in your templates harmful characters will be neutralised.

sunkencity• 18 years ago

> but the best-known Rails sample code is all vulnerable.

Rails is moving so fast now that most sample code is very outdated. Take authentication for example, there's at least 5 different plugins, all favoured as the best way to authenticate in rails at one time or another. Totally hopeless for a newbie to dig out which is the solution to go with, or at least it's a few days trial and error, trying out tutorials here and there. I've done a few rails projects on and off and each time I come back there's tons of new stuff, which is really great, but I would personally like to have more batteries included or "blessed" official plugins because I don't spend all my time in rails land, and it's hard to keep track of all the new goodies.

Really interesting article.

mtw3• 18 years ago

not every rails application needs authentication.

KirinDave• 18 years ago

Look, it's fair to freak out, but it's also fair to point out that most people have known about this problem for a long time. I was scrubbing my hashes of unwanted keys as far back as when I wrote ma.gnolia.com in 2006.

And it was considered common knowledge back then. And most people don't fix it using attr_protected, so are we really sure that all those projects are vulnerable? A simple string search would not suffice.

tptacek10• 18 years ago

Nobody's panicking, are they? My company chose Rails, and I'm mostly happy with it. I'm just calling a spade a spade.

100k6• 18 years ago

Eric executed actual attacks against all the projects mentioned in the article. Most of them resulted in data corruption (e.g., making a page unviewable by setting a non-existent user ID) but on one he was able to change his order status to "paid".

billroberts• 18 years ago

It would be crazy to assign unfiltered params to your model objects/DB and I would be astonished if anyone did it - except I suppose inexperienced programmers following simplified example code. But if you code web apps without knowing roughly what you're doing, you're going to fall into security traps whatever framework you use.

mhartl• 18 years ago

Thanks go out to Eric for this article, which led (among other things) to fixing some important bugs in Insoshi. You can find my companion post on fixing Rails mass assignment problems here:

http://news.ycombinator.com/item?id=311533

lpgauth• 18 years ago

Doesn't protect_from_forgery solves this? I'm pretty sure when I tried using curl the other day I was getting a message error message because the form was missing the secret.

100k6• 18 years ago

That's to protect against cross site request forgery. This is setting sensitive attributes via post. If a post has the authentication token, it can still set sensitive attributes.

cosmo7• 18 years ago

The problem isn't that rails is insecure (it is, but that isn't the point.) The problem is that rails by definition attracts developers who don't really like developing.

If the entire USP of your platform is that it cuts corners you'll see it put to use by people who either don't care or don't know any better.

I'm not saying there aren't good rails developers, but in my experience they are a minority.

Is your Rails application safe?

Related Stories