News for hackers. Stuff that matters.

A comment on SQL Injection Vulnerability in Ruby on Rails; affects all versions. Parent comment

Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by tptacek on Wednesday January 02, 2013 @10:18PM (#5000874)
It is possible, but not straightforwardly. There isn't a code path I know of that converts param keys to symbols.

(I wouldn't have said it was possible unless I had a curl line that did it, for what it's worth.)

[ Parent | on HN ]
Re:SQL Injection Vulnerability in Ruby on Rails; affects all... by cheald on Wednesday January 02, 2013 @10:21PM (#5000888)
You're the expert here, but that's really disturbing. Is it fixable?
[ Parent | on HN ]