Re:SQL Injection Vulnerability in Rails
by mseebach on Friday June 01, 2012 @11:25AM
(#4053907)
I'm not terribly familiar with the Rails feature in question, but it seems to me that GET/POST params should never be interpreted automatically. Parsing a param into any other type than a string should be explicit.
[ Parent
| on HN ]
You're (respectfully) not terribly familiar with Rails, then, because the interpretation of foo[bar]=xxx as { :foo => { :bar => 'xxx' } } is one of the core patterns in the framework. Code all across the platform depends on that behavior.
This is the same with PHP. Be aware anyone using something like MongoDB, if you don't sanitize/cast your inputs, your app could be vulnerable.
e.g. if you have the code:
$collection->findOne( array( 'username' => $_POST['username'], 'password' => $_POST['password'] ) );