que

Security Guide

The attacker creates a valid session id: He loads the login page of the web application where he wants to fix the session, and takes the session id in the cookie from the response (see number 1 and 2 in the image). He possibly maintains the session. Expiring sessions, for example every 20 minutes, greatly reduces the time-frame for attack. Therefore he accesses the web application from time to time in order to keep the session alive. Now the attacker will force the user’s browser into using this session id (see number 3 in the image). As you may not change a cookie of another domain (because of the same origin policy), the attacker has to run a JavaScript from the domain of the target web application. Injecting the JavaScript code into the application by XSS accomplishes this attack. Here is an example: <script> document.cookie="_session_id=16d5b78abb28e3d6206b60f22a03c8d9...

Full article: http://guides.rubyonrails.org/security.html#mass-assignment

Tweets

@davidbarral » 30 Mar '12, 5am
@asischao @websaurus yo tampoco lo llamaría bug. Es una peculiaridad documentada que tienes que saber cómo utilizar [link]
@frankieroberto » 06 Mar '12, 1pm
@frabcus or just read [link] and learn to how protect your sensitive attributes from mass-assignment.
@tokujia » 06 Mar '12, 1pm
Ruby On Rails Security Guide　[link]
@yagooar » 06 Mar '12, 8am
After the whole Github Mass-assignment affaire, it's good to take the time to review our projects: [link]
@kreeger » 05 Mar '12, 5pm
If you're using Rails, educate yourself on mass-assignment. It's important stuff. [link]
@nkavassalis » 05 Mar '12, 4pm
Mass assignment is Rail's PHP-register-globals moment - except harder to prevent your devs from being vulnerable to. [link]
@linuxonrails » 05 Mar '12, 2pm
Hay que tener cuidado con el asignamiento masivo. Mas información en la guía de seguridad de Rails: [link]
@olizilla » 05 Mar '12, 11am
SILLY RAILS DEVELOPER. I TOLD U I WAS GONNA MAKE URE DATAZ PUBLIC. [link] [link]
@attheodo » 05 Mar '12, 11am
All Rails DevOps should immediately read this: [link] If GitHub got pwnd, you'll get pwnd too... RT
@terrorobe » 05 Mar '12, 8am
TIL that Ruby on Rails implemented register_globals. [link] [link] #the_90ies_called #github_drama
@qihnus » 05 Mar '12, 3am
总之又是开发者的错误 [link]
@paulodeleo » 05 Mar '12, 2am
@RafaelChefe [link]
@sc68cal » 04 Mar '12, 8pm
Wow - Rails readily admits that their magic creates huge security holes.... [link]
@JonathanPidgeon » 04 Mar '12, 8pm
So many rails sites are vulnerable unless they have implemented what is described on this page: [link]

Security Guide

que

Tweets

Preventing mass assignment vulns in RoR: Good l...

In the world of web app frameworks good feature...

Super excited about , which just landed on Rail...

A Fresh Cup - Home - What's New in Edge Rails #11

“Rail Spikes: Is your Rails application safe?”

link: Ruby on Rails Guides: Ruby On Rails Secur...

Ruby on Rails Guides: A Guide to Testing Rails ...

@matthewlang not sure if you've seen/used this ...

2012 Buyer's Guide Shoes And Accessories - Golf...

A Guide to Singapore's online restaurant bookin...

A Guide to Singapore's online restaurant bookin...

Ruby on Rails Guides: Getting Started with Rails:

6 Steps To Refactoring Rails (for Mere Mortals)...

#OWASP Redmine is still vulnerable against CSRF...

はじめる!Rails3 第3巻について（経過報告） - Rails 雑感 - Ruby on ...