Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rails]

The tag has no usage guidance.

2
votes
0answers
134 views

How does the Ruby on Rails CSRF Protection Work?

I am not sure i completely understand how Ruby on Rails handles CSRF protection. My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
1
vote
0answers
44 views

Odd rails filter allows <script> tag but not <% %>

I am on a pentest for a client and they have a custom rails app that allows admin accounts to change page contents. While the front end editor filters script tags the backend does not, so using Burp I ...
0
votes
0answers
202 views

Single Page Application and CSRF Token generated every time

I need to use a Single Page Application (React, Ember, Angular, I don't care) with Rails CSRF protection mechanism. I'm wondering if I need to create a token evey time in the ApplicationController ...
1
vote
1answer
38 views

How to verify Ruby on Rails projects are at current patch levels?

I've got a few Ruby on Rails systems running Ubuntu 14.04LTS. The Ubuntu version of supported Ruby is 1.9.1 but the developers use a Gemfile and Bundler which (AFAIK) installs Ruby (and gems) out-of-...
5
votes
0answers
270 views

Ruby Devise salt exposed

The remember_user_token cookie token generated by the Ruby Devise authentication component reveals part of a bcrypt salted credential when decoded. For example: remember_user_token=...
3
votes
1answer
241 views

How to find the origin of some invasive html?

I've been working on the site https://founderspledge.com/ and just noticed that if you go to the main page, and open the Chrome console to view the source, there's an element that I certainly didn't ...
1
vote
1answer
98 views

How to transfer the `id` more securely in Rails project?

I checked my rails project with a brakeman, and received warning. Potentially dangerous key allowed for mass assignment: params.require(:inspector_id) class ReportsController < ...
1
vote
2answers
56 views

Session-storing an encryption key password

For a webapp which stores encrypted files, a public key is used to encrypt random key/ivs, which are used to encrypt the stored files. The private key, used for decryption, is guarded with a password ...
0
votes
1answer
309 views

Where should the authorization logic go in an api based application?

I have a brand new Rails api based application, where i need to implement authorization. Overall Architecture: React frontend -> Rails API layer -> Rails model/server layer While exploring ...
3
votes
3answers
428 views

Plain text Rails environment variables and security

I work for a healthcare company that emphasizes security, due to the sensitivity of the data that we work with. Recently, we've been doing a lot of auditing (internal and external) of our current "...
3
votes
1answer
118 views

Unauthorised access to admin area of a rails app, from the company's IP

As a company, we have a rails application with an administration panel, using active admin gem. If the user has the admin role, then a link to administration page appears. Yesterday, someone got into ...
3
votes
2answers
477 views

Is sending IP Address as a parameter with a POST request from a client to a rails server safe? [closed]

I am trying to get the IP address and send it to my rails server as a parameter of a POST request. Is this action safe?
3
votes
1answer
128 views

Possibility of SQLI in the following request?

I was testing an web application which is written in Ruby, Rails framework, when I stumbled on the following request which was sent. I modified the request and now it displays me a part of the query ...
4
votes
2answers
179 views

Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?

The following code is part of a program that is spawned at every request by the nginx’s ruby on rails script : static void time_t_to_dos_time(time_t user_supplied_time_t, int *dos_date, int *dos_time)...
0
votes
1answer
1k views

SQL injection in find_by Active Record RoR 4

I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0. Now, I have limited experience with RoR so please ...
10
votes
2answers
6k views

XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

Recently working on a Rails-based web application for a company, I had to look into XSS vulnerability. It turns out that the application, in some places, could take an HTML tag (e.g., <script>...
4
votes
1answer
65 views

Is it safe to store billing/postal addresses?

I'm currently building a web application in Ruby on Rails. Is it safe to store billing/postal addresses in a database? What could happen if the data were compromised? Are there any standard ...
2
votes
0answers
438 views

Store encrypted data and encryption key on different MongoDB servers? [closed]

In my Rails app users are submitting sensitive username/password combinations to their webshop systems so my app can interact with them. I need to enforce a high data-at-rest security for these data. ...
0
votes
1answer
496 views

Is sharing a CSRF token between Rails apps secure?

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app). The 'secondary' app that lives under a path consumes REST APIs from the 'main' ...
5
votes
3answers
2k views

How can I defend against malicious GET requests?

My server is getting hit with a variety if requests like the following: Started GET "/key/values" ActionController::RoutingError (No route matches [GET] "/key/values") Started GET "/loaded" ...
0
votes
1answer
1k views

Authorization/authentication strategy for micro service apps

How can one enforce authorization/authentication for micro service apps? And also, how to achieve SSO (single sign-on) from an end user's perspective? E.g: Assume a shopping site which has many micro ...
6
votes
1answer
435 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) each ...
2
votes
1answer
481 views

Can you store sensitive app config vars in the environment and be PCI compliant?

Note: this is a cross post from my question on SO. Feel free to keep the one in the more relevant location and close the other. We have a rails app which will be deployed on torquebox/jboss. (This in ...
1
vote
1answer
6k views

Checking if current user exists before executing code

In one of my controllers I have this method: def method_name if current_user @model = Model.find(params[:id]) if @model.destroy flash.alert = 'Model deleted successfully' ...
0
votes
3answers
204 views

What can I do to increase security of a small open source application [closed]

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
2
votes
2answers
1k views

Possible attack on website

I am a developer and I therefor I have very little knowledge on security. So I need some help understanding the attack on website which we launched recently for one of our client. Website is built on ...
0
votes
1answer
435 views

Preventing body onload xss that is injected as a request parameter

I have a rails 4.0.1 app that allows locale as a request parameter. Here is what i saw when i tested my app on firefox; http://localhost:3000/pages?locale=en_EN%22%3E%3Cbody%20onload=%22alert%28%...
1
vote
2answers
2k views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
6
votes
3answers
759 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
1
vote
2answers
1k views

How to test my website for the rails YAML vulnerability

I am quite puzzled by how to test my rails app for the YAML vulnerability first, I upgraded to the latest rails 3.2.11, and I tried this It gave me not likely to be vulnerable or URIPATH must be set ...
0
votes
1answer
185 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
1
vote
2answers
268 views

Do these mysql and ssh issues mean my rails server was hacked?

I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...
4
votes
2answers
705 views

Can anybody recommend any gems for checking security vulnerabilities? [closed]

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
3
votes
2answers
2k views

Is my current method of handling session cookies insecure?

I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security. Each user can have several accounts. For ...
4
votes
1answer
245 views

Security of rails user access/permissions plugins

I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
21
votes
2answers
4k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...