rails security note « snax

@charliesome ? Also there's the query params etc.

Rails Ticket 4339 suggests that there is a denial-of-service vulnerability because of the way the Rails request handler instantiates a symbol for every incoming request method. This is technically true, but turns out not to matter, as seen below. help i’m allocated and i can’t get released There are only a few valid HTTP request methods: GET , POST , PUT , etc. But Rails creates the symbol before it figures out what to do about it. If you make a FOO /index.html HTTP/1.1 request, Rails will instantiate a :foo symbol. As you know each unique symbol requires ~60 bytes of memory in the Ruby intepreter and is never garbage collected. The idea is that by spamming the server with lots of bogus request methods you can exhaust its memory space. whatever man It’s easy to write a script to exploit this with a small change to rfuzz . I ran such a script against a localhost-mounted gen...

Full article: http://blog.evanweaver.com/2006/09/18/rails-security-note/