Rails is Secure
0 likes390 views
The document discusses security issues with Rails applications. It notes that while Rails can be secure, much depends on the architecture and practices used. Poor architecture like tight coupling and lack of testing expose applications to exploits. The document recommends following SOLID principles for better architecture, using ActiveModel for parameters instead of directly accessing databases, and implementing layered architectures for improved security.
Rails is Secure
- 1. Rails is Secure but YMMV Franck Verrot, Lyon.rb, March 2012
- 2. Me! • Franck Verrot • http://twitter.com/cesariogw • http://github.com/cesario • Co-Founder of evome • Currently awesoming at shazino
- 3. @hamakov
- 5. @hamakov • Hacked GitHub • Exploited bad architecture
- 6. @hamakov • Hacked GitHub • Exploited bad architecture • Exploited current Rails worst practices
- 7. Software Architecture 101
- 8. SOLID principles • Single Responsibility • Open/Close • Liskov Substitution • Interface Segregation • Dependency Inversion
- 10. What’s the problem? Rails + ActionPack 1 class PostsController < ApplicationController 2 respond_to :html, :json 3 def index 4 respond_with(@posts = Post.all) 5 end 6 end
- 11. What’s the problem? Rails + ActionPack 1 class PostsController < ApplicationController 2 respond_to :html, :json 3 def index 4 respond_with(@posts = Post.all) 5 end 6 end
- 12. Architecture at risk (scary title I know)
- 13. Issues • Tight coupling: referencing a constant • Hard to test: referencing a constant • AR pattern FTL: DB table in a form!?
- 14. Refactor!
- 15. (Wrong) Solutions • Think attr_accessible is the way to go • config.active_record.whitelist_attributes = true
- 17. (Better) Solutions (YMMV) • Ban “params” (Rails #2510 “request.params”) • Use an ActiveModel object for validating parameters
- 18. (Other) Solutions (WIP) • https://github.com/technoweenie/ tainted_hash • https://github.com/rails/strong_parameters
- 20. Thanks for listening! Q&A