Forum: Ruby on Rails acts_as_taggable sql injection vulnerability

Announcement (2017-05-07): is now read-only since I unfortunately do not have the time to support and maintain the forum any more. Please see and for other Rails- und Ruby-related community platforms.
F7d94c4c159ec28690c0190bbd304ec4?d=identicon&s=25 Courtenay (Guest)
on 2005-12-16 03:05
(Received via mailing list)
Hey everyone!

If you're using acts_as_taggable <= 1.04, (erm, any version, I
think..) please fix your local copy right now!  There are numerous sql
sanitization holes in this library.

I notified Obie of this over a month ago, so hopefully he's fixed it.

How to tell lif you're vulnerable
Make a tag with a single quote in it.  See if raises an error.
Now, go delete your entire database.

How to fix
add/change the last line of split_tag_names

tag_names = { |name|
  ActiveRecord::Base.connection.quote_string( }

-- Remember to restart your app.

court3nay :: we like big fonts and yellow highlighting :: personal codelog :: just like all the cool kids
0e1f913bd7b6e69419fe88c82c9a15ed?d=identicon&s=25 Sean Stephens (Guest)
on 2005-12-16 04:42
(Received via mailing list)
" :: we like big fonts and yellow highlighting "

Ha!  This killed me...
This topic is locked and can not be replied to.