Questions tagged [rails]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
29 views

Ruby Active Storage blob keys?

What are the security impacts of revealing the keys to the user? I googled around and only found the ruby documentation. But did not find any article on how it affects security. Is it just because of ...
0
votes
1answer
66 views

How to prevent an user from tampering a request using Burp

Our rails application has a feature where admin can from trigger sending verify email to users that haven't been verified yet but not to verified ones. However, it was pointed out that by ...
0
votes
1answer
50 views

Rails File.open(#{Rails.root}) is vulnerable to LFI?

I am performing White Box testing on Rails application with static code analyzing tools like brakeman, I came across an instance where the developer is loading images using file.open. file = File....
0
votes
0answers
30 views

Is it safe to pass user input through rails gsub?

Are there risks associated with using gsub on user input? Can it be used for regular expression DoS?
0
votes
1answer
91 views

How to fix XSS in rails

I am able to inject javascript:alert `1` or javascript:alert(1) into the href field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode ...
0
votes
1answer
73 views

is there any need to encrypt sensitive images in a database?

I have a project that requires users to submit a photo of a driver's license as proof of identity. This image just needs to be seen once by an administrator, and has no use after their id is verified. ...
2
votes
0answers
199 views

How does the Ruby on Rails CSRF Protection Work?

I am not sure i completely understand how Ruby on Rails handles CSRF protection. My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
1
vote
0answers
48 views

Odd rails filter allows <script> tag but not <% %>

I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I ...
1
vote
1answer
45 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
6
votes
1answer
454 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
3
votes
1answer
292 views

How to find the origin of some invasive html?

I've been working on the site https://founderspledge.com/ and just noticed that if you go to the main page, and open the Chrome console to view the source, there's an element that I certainly didn't ...
1
vote
1answer
131 views

How to transfer the `id` more securely in Rails project?

I checked my rails project with a brakeman, and received warning. Potentially dangerous key allowed for mass assignment: params.require(:inspector_id) class ReportsController < ...
1
vote
2answers
69 views

Session-storing an encryption key password

For a webapp which stores encrypted files, a public key is used to encrypt random key/ivs, which are used to encrypt the stored files. The private key, used for decryption, is guarded with a password ...
0
votes
1answer
405 views

Where should the authorization logic go in an api based application?

I have a brand new Rails api based application, where i need to implement authorization. Overall Architecture: React frontend -> Rails API layer -> Rails model/server layer While exploring ...
3
votes
3answers
500 views

Plain text Rails environment variables and security

I work for a healthcare company that emphasizes security, due to the sensitivity of the data that we work with. Recently, we've been doing a lot of auditing (internal and external) of our current "...
2
votes
1answer
136 views

Unauthorised access to admin area of a rails app, from the company's IP

As a company, we have a rails application with an administration panel, using active admin gem. If the user has the admin role, then a link to administration page appears. Yesterday, someone got into ...
3
votes
2answers
595 views

Is sending IP Address as a parameter with a POST request from a client to a rails server safe? [closed]

I am trying to get the IP address and send it to my rails server as a parameter of a POST request. Is this action safe?
3
votes
1answer
140 views

Possibility of SQLI in the following request?

I was testing an web application which is written in Ruby, Rails framework, when I stumbled on the following request which was sent. I modified the request and now it displays me a part of the query ...
4
votes
2answers
222 views

Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?

The following code is part of a program that is spawned at every request by the nginx’s ruby on rails script : static void time_t_to_dos_time(time_t user_supplied_time_t, int *dos_date, int *dos_time)...
1
vote
1answer
1k views

SQL injection in find_by Active Record RoR 4

I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0. Now, I have limited experience with RoR so please ...
11
votes
2answers
7k views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., <script>...
3
votes
1answer
68 views

Is it safe to store billing/postal addresses?

I'm currently building a web application in Ruby on Rails. Is it safe to store billing/postal addresses in a database? What could happen if the data were compromised? Are there any standard ...
2
votes
0answers
480 views

Store encrypted data and encryption key on different MongoDB servers? [closed]

In my Rails app users are submitting sensitive username/password combinations to their webshop systems so my app can interact with them. I need to enforce a high data-at-rest security for these data. ...
0
votes
1answer
543 views

Is sharing a CSRF token between Rails apps secure?

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app). The 'secondary' app that lives under a path consumes REST APIs from the 'main' ...
5
votes
3answers
3k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
0
votes
1answer
1k views

Authorization/authentication strategy for micro service apps

How can one enforce authorization/authentication for micro service apps? And also, how to achieve SSO (single sign-on) from an end user's perspective? E.g: Assume a shopping site which has many micro ...
6
votes
1answer
462 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) each ...
2
votes
1answer
509 views

Can you store sensitive app config vars in the environment and be PCI compliant?

Note: this is a cross post from my question on SO. Feel free to keep the one in the more relevant location and close the other. We have a rails app which will be deployed on torquebox/jboss. (This in ...
1
vote
1answer
6k views

Checking if current user exists before executing code

In one of my controllers I have this method: def method_name if current_user @model = Model.find(params[:id]) if @model.destroy flash.alert = 'Model deleted successfully' ...
0
votes
3answers
217 views

What can I do to increase security of a small open source application [closed]

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
2
votes
2answers
1k views

Possible attack on website

I am a developer and I therefor I have very little knowledge on security. So I need some help understanding the attack on website which we launched recently for one of our client. Website is built on ...
1
vote
1answer
444 views

Preventing body onload xss that is injected as a request parameter

I have a rails 4.0.1 app that allows locale as a request parameter. Here is what i saw when i tested my app on firefox; http://localhost:3000/pages?locale=en_EN%22%3E%3Cbody%20onload=%22alert%28%...
1
vote
2answers
2k views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
6
votes
3answers
795 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
1
vote
2answers
1k views

How to test my website for the rails YAML vulnerability

I am quite puzzled by how to test my rails app for the YAML vulnerability first, I upgraded to the latest rails 3.2.11, and I tried this It gave me not likely to be vulnerable or URIPATH must be set ...
0
votes
1answer
188 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
1
vote
2answers
269 views

Do these mysql and ssh issues mean my rails server was hacked?

I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...
4
votes
2answers
721 views

Can anybody recommend any gems for checking security vulnerabilities? [closed]

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
3
votes
2answers
2k views

Is my current method of handling session cookies insecure?

I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security. Each user can have several accounts. For ...
5
votes
1answer
247 views

Security of rails user access/permissions plugins

I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
21
votes
2answers
4k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...