Understanding what characters are escaped by AR
Posted on November 9, 2007 - Filed Under RubyOnRails, Security
If you're new here, you may want to subscribe to my RSS feed. You can also get updates by email Thanks for visiting!
Working on Facebook application for my customer I’ve been reminded about some basic facts of strings escaping by ActiveRecord. I found a code which could be bug cause in some circumstances - when using find with :conditions => [ "some_field = ?", attr].
This pattern makes attr string passed to database engine safe in context of SQL injection, and is required when dealing with any untrusted data. But You have to remember about % sign, it could be dangerous.
In my customer application there is feature of searching through user database, but it should show only exact matches to last name. There was check to force query to have at least 3 chars, but when You provided % three times, application happily dumped list of all users.
So remember about % sign when results should not return whole dataset.
Popularity: 5% [?]
Hits for this post: 1246
Similar Posts
- New search tool on NetManiac
- Email verification - regexp
- Testing Rails application with ActsAsAuthenticated plugin
- MySQL collate setting in Rails application
- Run-N-Share is still alive!
Comments
Leave a Reply
