News for hackers. Stuff that matters.

A comment on IOS 6 injecting should_group_accessibility_children to POST requests. Parent comment

Re:IOS 6 injecting should_group_accessibility_children to PO... by untog on Wednesday October 03, 2012 @10:47AM (#4607640)
This isn't a Rails issue, it can affect any web framework. And it's a security flaw every single time mass assignment is used without whitelisting.
[ Parent | on HN ]
Re:IOS 6 injecting should_group_accessibility_children to PO... by masklinn on Wednesday October 03, 2012 @11:00AM (#4607722)
> This isn't a Rails issue, it can affect any web framework.

Not exactly. Most web frameworks don't have a built-in "mass assignment", let alone enable it by default.

[ Parent | on HN ]
Re:IOS 6 injecting should_group_accessibility_children to PO... by untog on Wednesday October 03, 2012 @11:14AM (#4607812)
Well, true. I wonder how many people pass their models straight into a schema-less database without any checks?
[ Parent | on HN ]