Skip to content

Comment on How github was hacked

Comments

I find it really surprising that Rails is taking heat for this. "Protect your attributes" is something you learn really early on, and most of my models will have a spec along the lines of "as a user, I can't steal another user's _____"

On top of that, public facing code should be written like

  def update
    @pk = current_user.public_keys.find(params[:id])
    # do the update if you find the key
  end
Simple stuff.

Learning to avoid register_globals and magic_quotes and SQL injections in PHP is what brought many people to Rails. It's sad to see similar choices being made there too.

It won't help. After @pk.update_attr(params[:pk]) you drop mailicious pub key to user params[:pk][:user_id] no way

Ah that's right, in this case he's trying to make something that belongs to him belong to someone else. Regardless, something like user_id should be protected and really if you're setting up a website whose primary audience is made up of hackers you should be whitelisting on every model.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.