Eaden McKee home blog

2 Ruby on Rails security tips

Working on open source rails applications, I sometimes come across security issues. Rails makes writing secure code reasonably easy - it's hard to make a SQL injection hole in a rails app without trying - but there are a couple of common issues I see repeatedly.

Regular expressions are oven used for validation. However ruby's regexes can behave differently to what you'd expect. Say you're validating an IP address and you have a regular expression that matches an IP address, do not use /^[regex]$/, use /\A[regex]\z/ instead

In ruby, the ^ and $ characters match the beginning and end of line. An attacker can bypass the validation by inserting a newline after a valid IP address, then whatever content he wants. \A and \z should be used instead of ^ and $ - they match the start and end of the string instead of the line. If you want to test out your ruby regular expressions, check out Rubular.

This second tip is well known, but I'll mention it here because it's important.
I'm not going to repeat the API docs, so I'll just say, make sure you understand attr_accessible: and why you would want to use it. Hint: if you have an admin variable on a user model for example, and it isn't protected from mass assignment, I can become an admin by modifying a user edit form.

Other Posts

Eaden McKee
eadz@eadz.co.nz

github.com/eadz
twitter.com/eadz
flickr.com/photos/eadz
facebook.com/eadz.nz
Last Updated: Tue Oct 20 17:59:02 +1300 2009

Subscribe to RSS Feed