# Rubyonrails security issues? **URL:** \ **Category:** Rails\ **Created:** [October 12, 2007, 5:32pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068 "2007-10-12T17:32:42Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 12, 2007, 5:32pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/1 "2007-10-12T17:32:42Z")
Hello there, While working on a project, I notice something very weird :S If I type this in the URL [http://localhost:3000/my/friends/index/5](http://localhost:3000/my/friends/index/5) it changed all the URL :S:S:S:S [http://localhost:3000/my/friends/index/5?group=Friends](http://localhost:3000/my/friends/index/5?group=Friends) My link\_to is very simple \<%= link\_to group.name, :group =\> group.name %\> This way Rubyonrails will open security issues in my application :S like cross site scripting??? How do I prevent this and thanks for your help. PS: I know I can add to my link\_to :id =\> nil, but I cannot do this to every single link\_to in this project :S ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 5:50am UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/2 "2007-10-14T05:50:50Z")
i don’t understand what you’re asking… do you not want the id ‘5’ to appear in the url? On Oct 12, 11:32 am, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 1:20pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/3 "2007-10-14T13:20:57Z")
Jeff Emminger wrote: > i don’t understand what you’re asking… do you not want the id ‘5’ to > appear in the url? > > On Oct 12, 11:32 am, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) I want it to ignore whatever comes after index 🙂 ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 2:32pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/4 "2007-10-14T14:32:04Z")
Unless you use those params in yr method [and you’d have to write code to use them, so you’d know it] they’re not being used anyhow. RSL ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 4:19pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/5 "2007-10-14T16:19:37Z")
RSL \_\_\_ wrote: > Unless you use those params in yr method [and you’d have to write code > to use them, so you’d know it] they’re not being used anyhow. > > RSL Well, that’s the problem, I don’t use them inside my application, but the rails framework embedded the ID automatic? I have to assign :id =\> nil so it ignore it ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 4:29pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/6 "2007-10-14T16:29:37Z")
Allow me to reiterate: Unless you specifically use them in your controller methods, extra params on the url will _not_ be used and do _not_ pose a security threat. Hope that clears things up. RSL ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 4:47pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/7 "2007-10-14T16:47:45Z")
On Oct 14, 7:28 am, “Russell N.” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > RSL \_\_\_ wrote: > > Posted viahttp://www.ruby-forum.com/. > > Yah, but: (Sorry, I have to say this.) A dev who’s unclear on how his > > routes/URLs are generated, that’s a security issue. ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 5:03pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/8 "2007-10-14T17:03:33Z")
On 10/12/07, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > My link\_to is very simple > \<%= link\_to group.name, :group =\> group.name %\> > > This way Rubyonrails will open security issues in my application :S like > cross site scripting??? Huh? how so? > How do I prevent this and thanks for your help. Add your controller, with a leading slash. That will prevent defaults from being used in your link: \<%= link\_to group.name, :controller =\> ‘/my/friends’, :group =\> group.name %\> This is documented at ActionController::Base#url\_for. ---
**Author:** ![jamal](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/35a633/32.png) [@jamal](https://www.ruby-forum.com/u/jamal)\ **Post date:** [October 14, 2007, 5:04pm UTC](https://www.ruby-forum.com/t/rubyonrails-security-issues/117068/9 "2007-10-14T17:04:43Z")
On Oct 14, 7:47 am, gene tani [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > On 10/14/07, Jamal S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > > > ## I have to assign :id =\> nil so it ignore it > > > > > > Posted viahttp://www.ruby-forum.com/. > > Yah, but: (Sorry, I have to say this.) A dev who’s unclear on how his > routes/URLs are generated, that’s a security issue. Let me try to actually be helpful, since I can’t figure out where the param’s coming from either: I started David Black’s PDF mini-book on routing, it’s quite good, tho i forgot to bring it with me : [http://www.bookpool.com/sm/0132417995](http://www.bookpool.com/sm/0132417995)