# Security issue: a user can fill cache with random urls

**URL:** <https://www.ruby-forum.com/t/security-issue-a-user-can-fill-cache-with-random-urls/54321>\
**Category:** Rails\
**Created:** [March 1, 2006, 3:43pm UTC](https://www.ruby-forum.com/t/security-issue-a-user-can-fill-cache-with-random-urls/54321 "2006-03-01T15:43:00Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\
**Post date:** [March 1, 2006, 3:43pm UTC](https://www.ruby-forum.com/t/security-issue-a-user-can-fill-cache-with-random-urls/54321/1 "2006-03-01T15:43:00Z")

</div>

Say your app responds to : store/show/3 and caching is enable at the  
store controller level.

A route says : map.connect ‘store/:action/:id’, :controller =\> ‘store’

All the following urls will be processed and cached (the cache  
filling with ‘page not found’ messages) !

store/foo/bar  
store/show/090934298234897342  
store/show/090934598234897347  
store/show/090934294234897341  
store/show/090934298234897343  
…

How can I avoid this ?

Is there a way to disable caching ‘on the fly’, saying to rails :  
this page is an error, do not cache it.

Thank you for your help.

Gaspard

---

<div class="post-metadata">

**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\
**Post date:** [March 1, 2006, 5:11pm UTC](https://www.ruby-forum.com/t/security-issue-a-user-can-fill-cache-with-random-urls/54321/2 "2006-03-01T17:11:06Z")

</div>

Submit a patch ticket. Something like

# Index: actionpack/lib/action\_controller/caching.rb

— actionpack/lib/action\_controller/caching.rb (revision 3716)  
+++ actionpack/lib/action\_controller/caching.rb (working copy)  
@@ -129,6 +129,7 @@  
# cache\_page “I’m the cached content”, :controller =\>  
“lists”, :action =\> “show”  
def cache\_page(content = nil, options = {})  
return unless perform\_caching && caching\_allowed

- 

```
   return if content.nil? && @response.headers['Status'] &&

```

!(200…300).include?(@response.headers[‘Status’].to\_i)  
self.class.cache\_page(content || @response.body,  
url\_for(options.merge({ :only\_path =\> true, :skip\_relative\_url\_root =\>  
true })))  
end

–  
Kent

---

<div class="post-metadata">

**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\
**Post date:** [March 1, 2006, 5:20pm UTC](https://www.ruby-forum.com/t/security-issue-a-user-can-fill-cache-with-random-urls/54321/3 "2006-03-01T17:20:59Z")

</div>

It’s that simple !

Thanks, I didn’t know about the cache\_page function.

Gaspard

---

<div class="post-metadata">

**Author:** ![gazoduc](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/c5a1d2/32.png) [@gazoduc](https://www.ruby-forum.com/u/gazoduc)\
**Post date:** [March 1, 2006, 5:18pm UTC](https://www.ruby-forum.com/t/security-issue-a-user-can-fill-cache-with-random-urls/54321/4 "2006-03-01T17:18:04Z")

</div>

On 01/03/06, Gaspard B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Say your app responds to : store/show/3 and caching is enable at the  
> store controller level.  
> All the following urls will be processed and cached (the cache  
> filling with ‘page not found’ messages) !  
> How can I avoid this ?  
> Is there a way to disable caching ‘on the fly’, saying to rails :  
> this page is an error, do not cache it.

I conditionally enable page caching for found pages only.

def show  
@page = Page.find(param[:id])  
if @page  
render …  
cache\_page  
else  
render error page  
end  
end