Security hole found in Rails 2.3's http_authentication.rb

Re:Security hole found in Rails 2.3's http_authentication.rb by tptacek on Wednesday June 03, 2009 @03:23PM (#640245)

Yep, looks real enough to me. Confusion between "nil" and "false" in Ruby, where an assumed true/false return value actually takes on a third value that also matches a nil password.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by wglb on Wednesday June 03, 2009 @05:40PM (#640485)

Not being a ruby programmer, is there a defensive coding idiom that would have prevented this confusion?

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by rcoder on Wednesday June 03, 2009 @06:03PM (#640545)

You can always test for nil explicitly. Compare:

  unless foo
    # ... foo can be false or nil to reach this branch
  end

  unless foo == false
    # ... this branch is reached unless foo == false
  end

Since terseness is considered such a cardinal virtue amongst Ruby programmers (including myself), however, this kind of issue is often ignored, and difficult to detect unless your tests explicitly check for "truthy" and "non-truthy" values in addition to the true/false literals.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by wglb on Wednesday June 03, 2009 @06:12PM (#640557)

Thanks.

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by danishgolkonda on Saturday June 20, 2009 @07:03AM (#666340)

tell me in detail

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by ionfish on Wednesday June 03, 2009 @06:40PM (#640613)

  if object.nil?
    puts "Object is nil!"
  else
    puts "Object is not nil."
  end

[ Parent | on HN ]

Re:Security hole found in Rails 2.3's http_authentication.rb by lsb on Thursday June 04, 2009 @12:21PM (#641686)

Haskell obviously isn't Ruby, but its Maybe monad, where you have Just the login, or Nothing, looks pretty appealing.

[ Parent | on HN ]