jneen on How github was hacked

Totally avoidable via `Hash#slice`. Come on guys, this is common knowledge now.

    def update
      find_pk.update_attributes(params[:public_key].slice(...))
    end

ajross 14y

Missing the point. You have a code idiom that is insecure by default. Leaving out the slice produces working code with a critical vulnerability. Mistakes of omission are routine; people forget stuff all the time. The goal of a secure framework is to be tolerant of that kind of goof.

This API sucks rocks.

Comments