kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Added extra words of caution for guarding against SQL-injection attacks

Browse source 
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@46 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
This commit is contained in:
David Heinemeier Hansson 2004-12-06 18:08:35 +00:00
parent 6cc961555d
commit 2575b3b065
1 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
activerecord/lib/active_record/base.rb
View file

@ -71,10 +71,14 @@ module ActiveRecord #:nodoc:
# end
# end
#
# The +authenticate_unsafely+ method inserts the parameters directly into the query and is thus susceptible to SQL-injection
# attacks if the +user_name+ and +password+ parameters come directly from a HTTP request. The +authenticate_safely+ method, on
# the other hand, will sanitize the +user_name+ and +password+ before inserting them in the query, which will ensure that
# The <tt>authenticate_unsafely</tt> method inserts the parameters directly into the query and is thus susceptible to SQL-injection
# attacks if the <tt>user_name</tt> and +password+ parameters come directly from a HTTP request. The <tt>authenticate_safely</tt> method,
# on the other hand, will sanitize the <tt>user_name</tt> and +password+ before inserting them in the query, which will ensure that
# an attacker can't escape the query and fake the login (or worse).
#
# Beware, that the approach used in <tt>authenticate_unsafely</tt> is basically just a wrapped call to sprintf. This means that you
# still have to quote when using %s or use %d instead. So find_first([ "firm_id = %s", firm_id ]) is _not_ safe while both
# find_first([ "firm_id = '%s'", firm_id ]) and find_first([ "firm_id = %d", firm_id ]) are.
#
# == Overwriting default accessors
#