Forum: Ruby on Rails One more thing to add to your security portfolio

Announcement (2017-05-07): is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see and for other Rails- und Ruby-related community platforms.
Michael G. (Guest)
on 2009-02-26 13:28
(Received via mailing list)
I recently implemented a system which stores DNS names, and writes out
DNS zone files.  I found these to be rather useful tests:

  def test_name_with_newline_fails
    z = => "test\nzone")
    assert !z.valid?
    assert z.errors.on(:name)

  def test_name_with_space_fails
    z = => "test zone")
    assert !z.valid?
    assert z.errors.on(:name)

When I use these zone names, I _always_ append a specific string, e.g.

If someone creates a zone called "foo" I will call it
""  So, when I write out an A record, it would be
something like:

  puts "#{zone} A #{address}"

If the user happened to submit:  "hacker\n@ NS" -- we would have problems.

I thought this regular expression would catch it:


and indeed it does catch spaces, random control characters...  but not
newlines!  Much to my surprise, I needed to use \A instead of ^ and \Z
instead of $.  ^ matches the beginning of a _line_ and $ the end.  \A
and \Z match the beginning and ends of STRINGS.

Just a FYI, perhaps I am the only one out there who did not know this.

Chas Lemley (Guest)
on 2009-02-26 14:28
(Received via mailing list)
Thanks for that.  I did just read about this exact problem in the
rails guide on security:

Chas Lemley
This topic is locked and can not be replied to.