[B! security][rails] patorashã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

patorash id:patorash

securityã¨railsã«é–¢ã™ã‚‹patorashã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

#283 Authentication with Sorcery - RailsCasts
ã‚¨ãƒ”ã‚½ãƒ¼ãƒ‰250[å‹•ç”»ã‚’è¦‹ã‚‹, èªã‚€]ã§ã€Railsã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«ã‚¼ãƒã‹ã‚‰èªè¨¼æ©Ÿèƒ½ã‚’è¿½åŠ ã—ã¾ã—ãŸã€‚æ—¢å˜ã®ã‚µãƒ¼ãƒ‰ãƒ‘ãƒ¼ãƒ†ã‚£è£½ã®ãƒ„ãƒ¼ãƒ«ã‚’ä½¿ã„ãŸã„å ´åˆã¯ã€ä¸€éƒ¨ã®æ©Ÿèƒ½ã‚’è‡ªå‹•åŒ–ã—ã¦ãã‚Œã‚‹gemãŒã„ãã¤ã‹ã‚ã‚Šã¾ã™ãŒã€ä»Šå›žã®ã‚¨ãƒ”ã‚½ãƒ¼ãƒ‰ã§ã¯Sorceryã‚’ç´¹ä»‹ã—ã¾ã™ã€‚ Sorceryã¯ã‚·ãƒ³ãƒ—ãƒ«ãªãƒ„ãƒ¼ãƒ«ã§ã™ã€‚ã‚ãšã‹20ã®ãƒ¡ã‚½ãƒƒãƒ‰ã‚’æŒã¤ã ã‘ã§ã™ãŒã€ãŠã‚ˆãå¿…è¦ãªèªè¨¼æ©Ÿèƒ½ã®ã™ã¹ã¦ã‚’æä¾›ã—ã¾ã™ã€‚ãã®ã‚·ãƒ³ãƒ—ãƒ«ã•ã«åã—ã¦ãƒ•ãƒ«æ©Ÿèƒ½ã‚’æŒã¡ã€ã¾ãŸãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«æ–¹å¼ã‚’ã¨ã£ã¦ã„ã‚‹ãŸã‚ã€ä¾‹ãˆã°ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰ã®åˆæœŸåŒ–ã€æ´»å‹•ãƒã‚°ãªã©ã€å¿…è¦ãªéƒ¨å“ã®ã¿ã‚’é¸æŠžã—ã¦æœ‰åŠ¹åŒ–ã§ãã¾ã™ã€‚Sorceryã¯ä»–ã®èªè¨¼ç”¨gemã¨æ¯”è¼ƒã™ã‚‹ã¨ã‚ˆã‚Šä½Žã„ãƒ¬ãƒ™ãƒ«ã§å‹•ä½œã—ã€ã‚³ãƒ³ãƒˆãƒãƒ¼ãƒ©å±¤ã‚„ãƒ“ãƒ¥ãƒ¼å±¤ã®ã‚³ãƒ¼ãƒ‡ã‚£ãƒ³ã‚°ã¯é–‹ç™ºè€…ã«ã‚†ã ãã‚‰ã‚Œã¦ã„ã¾ã™ã€‚ä»Šå›žã®ã‚¨ãƒ”ã‚½ãƒ¼ãƒ‰ã§ã¯ã“ã®Sorceryã‚’ä½¿ã£ã¦æ—¢å˜ã®Railsã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã«èªè¨¼æ©Ÿèƒ½ã‚’ä»˜åŠ ã—ã¦ã„ãã¾ã™ã€‚ ã¯ã˜ã‚ã« å¯¾è±¡ã¨ã™ã‚‹ã‚¢ãƒ—ãƒª
patorash 2015/01/23
gem

rails

sorcery

security

railscasts
ãƒªãƒ³ã‚¯
ActiveRecordã®SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãƒ‘ã‚¿ãƒ¼ãƒ³
(Last Updated On: 2018å¹´10æœˆ7æ—¥)Railsã§å¤šç”¨ã•ã‚Œã¦ã„ã‚‹ActiveRecordã®ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ãƒ‘ã‚¿ãƒ¼ãƒ³ã‚’ç°¡å˜ã«ç´¹ä»‹ã—ã¾ã™ã€‚å‡ºå…¸ã¯rails-sqli.orgãªã®ã§ã‚ˆã‚Šè©³ã—ã„è§£èª¬ã¯ã“ã¡ã‚‰ã§ç¢ºèªã—ã¦ãã ã•ã„ã€‚ç‰¹ã«æ°—ã‚’ã¤ã‘ã‚‹å¿…è¦ãŒã‚ã‚‹ã¨æ€ã‚ã‚Œã‚‹ç‰©ã®ã¿ã‚’ãƒ”ãƒƒã‚¯ã‚¢ãƒƒãƒ—ã—ã¾ã—ãŸã€‚ Exists?ãƒ¡ã‚½ãƒƒãƒ‰ User.exists? params[:user] params[:user]ãªã©ã®ä½¿ã„æ–¹ã¯å±é™ºã§ã™ã€‚Railsã¯PHPãªã©ã¨åŒæ§˜ã«user[]ã¨ã„ã†ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿ãƒ¼ã§é…åˆ—åŒ–ã—ã¾ã™ã€‚ ?user[]=1 ãŒå…¥åŠ›ã®å ´åˆã€ SELECT 1 AS one FROM "users" WHERE (1) LIMIT 1 ã¨ãªã‚Šä¸æ£ãªã‚¯ã‚¨ãƒªãŒå®Ÿè¡Œã•ã‚Œã¾ã™ã€‚ Calculateãƒ¡ã‚½ãƒƒãƒ‰ Calculateãƒ¡ã‚½ãƒƒãƒ‰ã¯SQLã®é›†ç´„é–¢æ•°ã‚’å®Ÿè¡Œã™ã‚‹ãƒ¡ã‚½ãƒƒãƒ‰ã§ã™ã€‚averageã€calcula
patorash 2014/06/04
activerecord

rails

Ruby

programming

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Brakeman
Happy new year! This release of Brakeman contains several breaking changes and updates to default behavior. Changes since 6.2.2: Default to using Prism parser if available (disable with --no-prism) Disable following symbolic links by default (re-enable with --follow-symlinks) Remove updated entry in Brakeman ignore files (Toby Hsieh) Major changes to how rescanning works Fix hardcoded globally exc
patorash 2014/05/07
Rails

security

brakeman

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
Rails SQL Injection Examples
Overview The Ruby on Rails web framework provides a library called ActiveRecord which provides an abstraction for accessing databases. This page lists many query methods and options in ActiveRecord which do not sanitize raw SQL arguments and are not intended to be called with unsafe user input. Careless use of these methods can open up code to SQL Injection exploits. The examples here do not inclu
patorash 2014/05/07
sql

activerecord

rails

ruby

Security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

sql injection
ãƒªãƒ³ã‚¯
Rails 4.0.2, 3.2.16ãƒªãƒªãƒ¼ã‚¹ï¼é‡å¤§ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£FIXãŒã‚ã‚Šã¾ã™ï½œTechRacho by BPSæ ªå¼ä¼šç¤¾
æ˜¨æ—¥ã€Ruby on Railsã®é‡è¦ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã§ã‚ã‚‹ã€Rails 4.0.2ã¨3.2.16ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚ ã“ã®ãƒªãƒªãƒ¼ã‚¹ã«ã¯ã€5ä»¶(3.2.16ã«ã¯4ä»¶)ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£FIXãŒå«ã¾ã‚Œã¦ã„ã¾ã™ã€‚ é‡è¦åº¦ã®é«˜ã„ã‚‚ã®ãŒã‚ã‚‹ãŸã‚ã€æ—©æ€¥ãªã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆã‚’ã—ã¾ã—ã‚‡ã†ã€‚ CVE-2013-6416 simple_formatãƒ˜ãƒ«ãƒ‘ãƒ¼ã®XSSè„†å¼±æ€§ã«é–¢ã™ã‚‹ä¿®æ£ã§ã™ã€‚ â€»4.0.2ã®ã¿ã€‚3.2ç³»ã§ã¯å…ƒã‹ã‚‰ç™ºç”Ÿã—ãªã„ãŸã‚ã€3.2.16ã«ã¯å«ã¾ã‚Œã¾ã›ã‚“ã€‚ simple_formatã¯html_optionsã¨ã—ã¦Hashã‚’æ¸¡ã›ã¾ã™ãŒã€ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã€ã“ã®classæŒ‡å®šãŒHTMLã‚¨ã‚¹ã‚±ãƒ¼ãƒ—ã•ã‚Œã¦ã„ã¾ã›ã‚“ã§ã—ãŸã€‚ classæŒ‡å®šã‚’ãƒ¦ãƒ¼ã‚¶å…¥åŠ›ã«ã‚ˆã‚‹å ´åˆã€å®¹æ˜“ã«XSSãŒæˆç«‹ã—ã¦ã—ã¾ã„ã¾ã™ã€‚ simple_format "hello\nworld", class: '"><script>alert(1
patorash 2014/01/29
rails

security

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
ãƒªãƒ³ã‚¯
1