5 ms·
This has security implications! Example exploitable ruby code: unless person_id =~ /^\d+$/ abort "Bad person ID" end sql = "select * from people whe
by jewel 2y ago
This has security implications! Example exploitable ruby code:
unless person_id =~ /^\d+$/
abort "Bad person ID"
end
sql = "select * from people where person_id = #{person_id}"
In addition to injection attacks, this also can bite people when parsing headers, where a bad header is allowed to sneak past a filter.
- jfhufl 2y agoUnsure what you mean? $ ruby -e 'x = "25" ; if x =~ /^\d+$/ ; puts "yes" ; else ; puts "no" ; end' yes $ ruby -e 'x = "25\n" ; if x =~ /^\d+$/ ; puts "yes" ; else ; puts "no" ; end' yes $ ruby -e 'x = "a25\n" ; if x =~ /^\d+$/ ; puts "yes" ; else ; puts "no" ; end' no Also, you'd want to use something that parameterizes the query with '?' (I use the Sequel gem) instead of just stuffing it into a sql string.
- jfhufl 2y agoWell, learned something today after reading a bit further in the thread: ruby -e 'x = "a\n25\n" ; if x =~ /^\d+$/ ; puts "yes" ; else ; puts "no" ; end' yes Good to know.
- halostatue 2y agoYou need to make your regex multi-line (`/^\d+$/m`), but that isn't the problem shown. Your query will be searching for `25\n`, not `25` despite your pre-check that it’s a good value. The second line should always be no, which if you use `\A\d+\z`, it will be.
- jfhufl 2y agoYep, makes sense, thanks!
- dr-smooth 2y ago$ ruby -e 'x = "25\n; delete from people" ; if x =~ /^\d+$/ ; puts "yes" ; else ; puts "no" ; end' yes
- mnau 2y agoPractical Gitlab RCE that involved end of line regex in ExifTools: https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execu...