Rubyonrails security issues?

Rails
1

Hello there,

While working on a project, I notice something very weird :S

If I type this in the URL
http://localhost:3000/my/friends/index/5

it changed all the URL :S:S:S:S
http://localhost:3000/my/friends/index/5?group=Friends

My link_to is very simple
<%= link_to group.name, :group => group.name %>

This way Rubyonrails will open security issues in my application :S like
cross site scripting???

How do I prevent this and thanks for your help.

PS: I know I can add to my link_to :id => nil, but I cannot do this to
every single link_to in this project :S

2

i don’t understand what you’re asking… do you not want the id ‘5’ to
appear in the url?

On Oct 12, 11:32 am, Jamal S. [email protected]

3

Jeff Emminger wrote:

i don’t understand what you’re asking… do you not want the id ‘5’ to
appear in the url?

On Oct 12, 11:32 am, Jamal S. [email protected]

I want it to ignore whatever comes after index :slight_smile:

4

Unless you use those params in yr method [and you’d have to write code
to use them, so you’d know it] they’re not being used anyhow.

RSL

5

RSL ___ wrote:

Unless you use those params in yr method [and you’d have to write code
to use them, so you’d know it] they’re not being used anyhow.

RSL

Well, that’s the problem, I don’t use them inside my application, but
the rails framework embedded the ID automatic?

I have to assign :id => nil so it ignore it

6

Allow me to reiterate: Unless you specifically use them in your
controller methods, extra params on the url will not be used and do
not pose a security threat. Hope that clears things up.

RSL

7

On Oct 14, 7:28 am, “Russell N.” [email protected] wrote:

RSL ___ wrote:
Posted viahttp://www.ruby-forum.com/.
Yah, but: (Sorry, I have to say this.) A dev who’s unclear on how his
routes/URLs are generated, that’s a security issue.

8

On 10/12/07, Jamal S. [email protected] wrote:

My link_to is very simple
<%= link_to group.name, :group => group.name %>

This way Rubyonrails will open security issues in my application :S like
cross site scripting???

Huh? how so?

How do I prevent this and thanks for your help.

Add your controller, with a leading slash. That will prevent defaults
from being used in your link:

<%= link_to group.name, :controller => ‘/my/friends’, :group =>
group.name %>

This is documented at ActionController::Base#url_for.

9

On Oct 14, 7:47 am, gene tani [email protected] wrote:

On 10/14/07, Jamal S. [email protected] wrote:

I have to assign :id => nil so it ignore it

Posted viahttp://www.ruby-forum.com/.

Yah, but: (Sorry, I have to say this.) A dev who’s unclear on how his
routes/URLs are generated, that’s a security issue.

Let me try to actually be helpful, since I can’t figure out where the
param’s coming from either: I started David Black’s PDF mini-book on
routing, it’s quite good, tho i forgot to bring it with me :

http://www.bookpool.com/sm/0132417995