Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by FuzzyDunlop on Monday January 28, 2013 @06:04PM (#5131311)

Are you basing this on how often the vulnerabilities get reported and upvoted on HN?

http://www.hnsearch.com/search#request/submissions&q=dja...

Django has had its fair share of patches. This is no reflection on the quality of the project, as it shouldn't be for any sufficiently complicated framework (like Rails).

I also think the vulnerabilities are similar enough to suggest that the first one gave valid reason to ensure the same issue doesn't occur elsewhere. Rather than dusting these issues under the rug or silently fixing them, they're being responsibly reported with patches and updates provided at the same time.

This doesn't seem like broken process to me.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by sandofsky on Monday January 28, 2013 @06:16PM (#5131373)

No. I'm basing it on this database:

http://www.cvedetails.com/vulnerability-list/vendor_id-12043...

http://www.cvedetails.com/vulnerability-list/vendor_id-10199...

Django has 16 vulnerabilities of the DoS, XSS, and CSRF variety.

Rails has 37. In addition to DoS, XSS, and CSRF, it has SQL injection and code execution.

That we keep seeing similar vulnerabilities suggests the problem is systemic.

Giving them praise for not sweeping these under the rug is giving someone praise for not being a sociopath.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by yannski on Monday January 28, 2013 @06:58PM (#5131531)

So what does that mean ? That Rails is twice as popular as Django ?

[ Parent | on HN ]