# One more thing to add to your security portfolio

**URL:** <https://www.ruby-forum.com/t/one-more-thing-to-add-to-your-security-portfolio/161427>\
**Category:** Rails\
**Created:** [February 26, 2009, 12:28pm UTC](https://www.ruby-forum.com/t/one-more-thing-to-add-to-your-security-portfolio/161427 "2009-02-26T12:28:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgreenly](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/85f322/32.png) [@mgreenly](https://www.ruby-forum.com/u/mgreenly)\
**Post date:** [February 26, 2009, 12:28pm UTC](https://www.ruby-forum.com/t/one-more-thing-to-add-to-your-security-portfolio/161427/1 "2009-02-26T12:28:30Z")

</div>

I recently implemented a system which stores DNS names, and writes out  
DNS zone files. I found these to be rather useful tests:

def test\_name\_with\_newline\_fails  
z = Zone.new(:name =\> “test\nzone”)  
assert !z.valid?  
assert z.errors.on(:name)  
end

def test\_name\_with\_space\_fails  
z = Zone.new(:name =\> “test zone”)  
assert !z.valid?  
assert z.errors.on(:name)  
end

When I use these zone names, I _always_ append a specific string, e.g.  
‘.example.com.’

If someone creates a zone called “foo” I will call it  
“[foo.example.com](http://foo.example.com).” So, when I write out an A record, it would be  
something like:

puts “#{zone}.example.com. A #{address}”

If the user happened to submit: “hacker\n@ NS  
[hacker-nameserver.example.com](http://hacker-nameserver.example.com).” – we would have problems.

I thought this regular expression would catch it:

```
/^[a-zA-Z0-9\-\_\.]$/

```

and indeed it does catch spaces, random control characters… but not  
newlines! Much to my surprise, I needed to use \A instead of ^ and \Z  
instead of $. ^ matches the beginning of a _line_ and $ the end. \A  
and \Z match the beginning and ends of STRINGS.

Just a FYI, perhaps I am the only one out there who did not know this.

–Michael

---

<div class="post-metadata">

**Author:** ![mgreenly](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/85f322/32.png) [@mgreenly](https://www.ruby-forum.com/u/mgreenly)\
**Post date:** [February 26, 2009, 1:28pm UTC](https://www.ruby-forum.com/t/one-more-thing-to-add-to-your-security-portfolio/161427/2 "2009-02-26T13:28:30Z")

</div>

Michael,  
Thanks for that. I did just read about this exact problem in the  
rails guide on security:

> **[rails.info](http://guides.rails.info/security.html#regularexpressions)**
>
> Ruby on Rails,Rails Tutorial,Ruby Basics,Rails 4,Bar Rails,Rail

Chas Lemley