# Guarding "params" (for security reasons) **URL:** \ **Category:** Rails\ **Created:** [December 20, 2008, 7:31pm UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107 "2008-12-20T19:31:51Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 20, 2008, 7:31pm UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/1 "2008-12-20T19:31:51Z")
What’s the most recommended technique for guarding Rails HTTP params? For example, something like this can obviously be dangerous (e.g. SQL injection) user\_account = UserAccount.find(:first, :conditions =\> [“username = ?”, params[:id]) I am about to write a home-grown validation routine to check for string lengths, data types (e.g. numeric versus string, depending on what I’m expecting), etc. but I wasn’t sure if there are existing plugins/libraries out there. I was considering writing something like this: id = validate\_params(params[:id], “string”, 10) # 10 being max\_length ---
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 20, 2008, 8:03pm UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/2 "2008-12-20T20:03:30Z")
Ben K. wrote: > What’s the most recommended technique for guarding Rails HTTP params? > > For example, something like this can obviously be dangerous (e.g. SQL > injection) > user\_account = UserAccount.find(:first, :conditions =\> [“username = > ?”, params[:id]) > > I am about to write a home-grown validation routine to check for string > lengths, data types (e.g. numeric versus string, depending on what I’m > expecting), etc. but I wasn’t sure if there are existing > plugins/libraries out there. > > I was considering writing something like this: > id = validate\_params(params[:id], “string”, 10) # 10 being > max\_length ActiveRecord has may validations callbacks such as validate\_presence\_of, etc. It’s preferrable to validate data in the models instead of controllers. Regards, # rp8 > **[Competo Solutions, Inc.](https://competo.com/)** > > Sharing our experience in ever changing tech landscapes ---
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 20, 2008, 8:16pm UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/3 "2008-12-20T20:16:22Z")
On 20 Dec 2008, at 18:31, Ben K. wrote: > What’s the most recommended technique for guarding Rails HTTP params? > > For example, something like this can obviously be dangerous (e.g. SQL > injection) > user\_account = UserAccount.find(:first, :conditions =\> [“username = > ?”, params[:id]) If you read the docs, you would know that this sanitizes parameters precisely to guard against such injection 🙂 Fred ---
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 21, 2008, 12:09am UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/4 "2008-12-21T00:09:41Z")
Frederick C. wrote: > If you read the docs, you would know that this sanitizes parameters > precisely to guard against such injection 🙂 Sorry, guys; my bad. I should have explained that I’m probably least worried about ActiveRecord.find stuff (even though I threw that example up) and more worried about params in general (i.e. ones not passed to ActiveRecord.find) and also worried about ActiveRecord::Base.connection.select\_all, count\_by\_sql, etc. I do have methods that accept params for non-ActiveRecord in a couple of places. I have used many of ActiveRecord’s validation callbacks (e.g. validate\_presence\_of) but I’ll dig deeper into those. However, I’m looking for a generic, non-ActiveRecord, params validation stuff. If you know of any, please let me know. Thanks again, everyone. ---
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 21, 2008, 1:39am UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/5 "2008-12-21T01:39:38Z")
Ben, I suspect that you’ll need to provide some more specific examples. I also suspect that you’re possibly over thinking things a bit (possibly due to how you might have approached problems like this in previous languages/frameworks) Robby On Sat, Dec 20, 2008 at 3:09 PM, Ben K. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > ActiveRecord::Base.connection.select\_all, count\_by\_sql, etc. I do have > > > – Robby R. Chief Evangelist, Partner PLANET ARGON, LLC design // development // hosting > **[Planet Argon](https://www.planetargon.com/)** > > Planet Argon is a Ruby on Rails development agency specializing in maintenance and support for existing Rails apps. Based in Portland, OR, Planet Argon has been a member of the Rails community since 2004. [http://www.robbyonrails.com/](http://www.robbyonrails.com/) aim: planetargon +1 503 445 2457 +1 877 55 ARGON [toll free] +1 815 642 4068 [fax] ---
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 21, 2008, 4:00am UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/6 "2008-12-21T04:00:31Z")
I’ve actually worked with Rails for 2+ years and published articles about it, so I hope I’m not over-thinking things 🙂 However, we recently began getting very long URLs with invalid parameters, which is what got me thinking of these things. This is 10% of the how long the URLs are – imagine this string times 10: {our domain}/4/pick-up-your-toys?code=+%0d%0ahttp%3a%2f%[2fwarn1207.hostevo.com](http://2fwarn1207.hostevo.com)%2fhome-rentals-in-brunswick.html+home+rentals+in+cape+cod+%0d%0ahttp%3a%2f%[2fpetr3549.yourfreehosting.net](http://2fpetr3549.yourfreehosting.net)%2fbaked-scrod-recipes.html+baked+spasagna+recipe+%0d%0ahttp%3a%2f ---
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 21, 2008, 5:35am UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/7 "2008-12-21T05:35:50Z")
I can’t really understand what you’re trying to do here. What is this URL? Where is it being used to be dangerous? Is it in activerecord code? If it is and you’re following the best practices (using placeholders to your conditions), this isn’t a problem (as Frederick has already explained). - Maurício Linhares [http://alinhavado.wordpress.com/](http://alinhavado.wordpress.com/) (pt-br) | [http://blog.codevader.com/](http://blog.codevader.com/) (en) On Sun, Dec 21, 2008 at 12:00 AM, Ben K. ---
**Author:** ![thabenksta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/97f17d/32.png) [@thabenksta](https://www.ruby-forum.com/u/thabenksta)\ **Post date:** [December 22, 2008, 1:15am UTC](https://www.ruby-forum.com/t/guarding-params-for-security-reasons/156107/8 "2008-12-22T01:15:58Z")
That URL is from our log files; I masked our domain name (see below). We are getting calls made with very long parameters made every couple of minutes and since they all from Windows NT machines, I suspect it’s a virus that the user might not even be aware of. Anyway, whether it’s a virus or deliberate attempt to crack our systems, I would like to guard our parameters, so only appropriate size and content is passed in. [http://www.ourdomain.com/4/pick-up-your-toys?code=+ http%3A%2F%2Fwarn1207.hostevo.com%2Fhome-rentals-in-brunswick.html+home+rentals+in+cape+cod+ http%3A%2F%2Fpetr3549.yourfreehosting.net%2Fbaked-scrod-recipes.html+baked+spasagna+recipe+ http%3A%2F](http://www.ourdomain.com/4/pick-up-your-toys?code=+%0d%0ahttp%3a%2f%2fwarn1207.hostevo.com%2fhome-rentals-in-brunswick.html+home+rentals+in+cape+cod+%0d%0ahttp%3a%2f%2fpetr3549.yourfreehosting.net%2fbaked-scrod-recipes.html+baked+spasagna+recipe+%0d%0ahttp%3a%2f) Maurício Linhares wrote: > I can’t really understand what you’re trying to do here. > > What is this URL? Where is it being used to be dangerous? Is it in > activerecord code? > > If it is and you’re following the best practices (using placeholders > to your conditions), this isn’t a problem (as Frederick has already > explained). > > - > > Maur�cio Linhares > [http://alinhavado.wordpress.com/](http://alinhavado.wordpress.com/) (pt-br) | [http://blog.codevader.com/](http://blog.codevader.com/) > (en) > > On Sun, Dec 21, 2008 at 12:00 AM, Ben K.