# XSS security patch

**URL:** <https://www.ruby-forum.com/t/xss-security-patch/174964>\
**Category:** Rails\
**Created:** [September 4, 2009, 8:57pm UTC](https://www.ruby-forum.com/t/xss-security-patch/174964 "2009-09-04T20:57:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pakothawade](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ba9def/32.png) [@pakothawade](https://www.ruby-forum.com/u/pakothawade)\
**Post date:** [September 4, 2009, 8:57pm UTC](https://www.ruby-forum.com/t/xss-security-patch/174964/1 "2009-09-04T20:57:23Z")

</div>

Hi,

Does anyone know how to apply the XSS security patch delivered by the  
rails community at  
[http://weblog.rubyonrails.org/assets/2009/9/4/2-3-timing-weakness.patch](http://weblog.rubyonrails.org/assets/2009/9/4/2-3-timing-weakness.patch)

When i try to click on the link it opens some cryptic page.

Thanks,  
Pratik

---

<div class="post-metadata">

**Author:** ![pakothawade](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ba9def/32.png) [@pakothawade](https://www.ruby-forum.com/u/pakothawade)\
**Post date:** [September 4, 2009, 8:58pm UTC](https://www.ruby-forum.com/t/xss-security-patch/174964/2 "2009-09-04T20:58:33Z")

</div>

sorry the patch is at  
[http://weblog.rubyonrails.org/assets/2009/9/4/2-3-CVE-2009-3009.patch](http://weblog.rubyonrails.org/assets/2009/9/4/2-3-CVE-2009-3009.patch)

---

<div class="post-metadata">

**Author:** ![pakothawade](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ba9def/32.png) [@pakothawade](https://www.ruby-forum.com/u/pakothawade)\
**Post date:** [September 4, 2009, 9:23pm UTC](https://www.ruby-forum.com/t/xss-security-patch/174964/3 "2009-09-04T21:23:20Z")

</div>

Pratik Khadloya wrote:

> Hi,
> 
> Does anyone know how to apply the XSS security patch delivered by the  
> rails community at  
> [http://weblog.rubyonrails.org/assets/2009/9/4/2-3-timing-weakness.patch](http://weblog.rubyonrails.org/assets/2009/9/4/2-3-timing-weakness.patch)
> 
> When i try to click on the link it opens some cryptic page.

No it doesn’t. The link, at least for me, leads to a standard  
patchfile. You should have no problem applying this with the patch  
command.

> Thanks,  
> Pratik

## Best,

Marnen Laibow-Koser  
[http://www.marnen.org](http://www.marnen.org)  
removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![pakothawade](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/ba9def/32.png) [@pakothawade](https://www.ruby-forum.com/u/pakothawade)\
**Post date:** [September 5, 2009, 12:30am UTC](https://www.ruby-forum.com/t/xss-security-patch/174964/4 "2009-09-05T00:30:28Z")

</div>

On Fri, Sep 4, 2009 at 1:57 PM, tispratik[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> sorry the patch is at [http://weblog.rubyonrails.org/assets/2009/9/4/2-3-CVE-2009-3009.patch](http://weblog.rubyonrails.org/assets/2009/9/4/2-3-CVE-2009-3009.patch)

Patches aren’t formatted for viewing in a browser, the newline  
characters will render as spaces, this is normal.

You probably want to do something like this:

cd /path/to/ruby/gems  
wget  
[http://weblog.rubyonrails.org/assets/2009/9/4/2-3-CVE-2009-3009.patch](http://weblog.rubyonrails.org/assets/2009/9/4/2-3-CVE-2009-3009.patch)  
cat 2-3-CVE-2009-3009.patch | patch -p1

–  
Greg D.  
[http://destiney.com/](http://destiney.com/)