Rails 3.2.18, 4.0.5 and 4.1.1 have been released

Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by kevinmchugh on Tuesday May 06, 2014 @02:25PM (#7706229)

There's also an 'Unsafe Query Risk', which is not a CVE and does not have a patch.[0]

I believe this script[1] should expose some of those dangerous columns. There's still the join alias risk, but I'm not sure, other than parsing a schema.rb, how to get at those effectively.

[0] https://groups.google.com/forum/#!topic/rubyonrails-security...

[1] https://gist.github.com/KevinMcHugh/fab941ec3677f9a19ee0

[ Parent | on HN ]

Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by jenseng on Tuesday May 06, 2014 @05:19PM (#7707145)

something like this will find any associations that share a name with a column in each model: https://gist.github.com/jenseng/2039fd57f5db40779871

[ Parent | on HN ]

Re:Rails 3.2.18, 4.0.5 and 4.1.1 have been released by Dorian-Marie on Tuesday May 06, 2014 @03:04PM (#7706446)

Thanks a lot for this script, I was going to check manually.

[ Parent | on HN ]