6 ms·

I just tried this on one of my side project sites and it's reporting it as being vulnerable. However I upgraded the site to Rails 3.2.1 last week (and just conf

by scotje 14y ago

I just tried this on one of my side project sites and it's reporting it as being vulnerable. However I upgraded the site to Rails 3.2.1 last week (and just confirmed that's the version in the bundle). Is there something that would cause a false positive or is my app really still vulnerable?

borski 14y ago
There is the potential for false positives, but I'd be happy to chat about it - feel free to get in touch either via email at support@tinfoilsecurity.com or in our support chat: http://www.tinfoilsecurity.com/chat http://www.tinfoilsecurity.com/chat ITYM 3.2.11? 3.2.1 is definitely vulnerable... We had a typo in ours that said 3.2.1 was safe - so sorry about that! Fixing that now. You should upgrade to 3.2.11.
- scotje 14y ago
  Aha, well apparently I never merged that commit into my deploy branch, so it was still actually on 3.2.1. That combined with the fact that your page had said 3.2.1 was safe caused my brain to short circuit and not realize that 3.2.11 is what it needed to be on. :) I'll redeploy and check it again, thanks guys!
  - borski 14y ago
    Yeah, that was totally our bad. I'm deploying the typo fix now. Let me know if you have any other issues! Happy to help.
    - scotje 14y ago
      See, in a very circular way I was just reporting the typo. :) (Looks good now that I have the right release deployed, by the way.)
      - borski 14y ago
        Ha, fair point. :) Glad you got it fixed!
- bensedat 14y ago
  We also are seeing a small group of apps with vulnerable applications even after upgrading to Rails 3.2.11, possibly due to a rogue middleware or other library. Disabling XML parsing entirely is one approach (see http://news.ycombinator.com/item?id=5035389 http://news.ycombinator.com/item?id=5035389) but we'd love to track it down further for everyone's good. Feel free to join us at https://www.tinfoilsecurity.com/chat https://www.tinfoilsecurity.com/chat if you'd like.
ScotterC 14y ago
Rails 3.2.1 or Rails 3.2.11. It has to be Rails 3.2.11 to get the patch
borski 14y ago
'bensedat seems to be hellbanned for some reason (Can a mod unhellban? He's definitely not a troll.) Anyway, echoing his comment: We also are seeing a small group of apps with vulnerable applications even after upgrading to Rails 3.2.11, possibly due to a rogue middleware or other library. Disabling XML parsing entirely is one approach (see http://news.ycombinator.com/item?id=5035389 http://news.ycombinator.com/item?id=5035389) but we'd love to track it down further for everyone's good. Feel free to join us at https://www.tinfoilsecurity.com/chat https://www.tinfoilsecurity.com/chat if you'd like.

by scotje 14y ago

borski 14y ago

There is the potential for false positives, but I'd be happy to chat about it - feel free to get in touch either via email at support@tinfoilsecurity.com or in our support chat: http://www.tinfoilsecurity.com/chat http://www.tinfoilsecurity.com/chat ITYM 3.2.11? 3.2.1 is definitely vulnerable... We had a typo in ours that said 3.2.1 was safe - so sorry about that! Fixing that now. You should upgrade to 3.2.11.

scotje 14y ago
Aha, well apparently I never merged that commit into my deploy branch, so it was still actually on 3.2.1. That combined with the fact that your page had said 3.2.1 was safe caused my brain to short circuit and not realize that 3.2.11 is what it needed to be on. :) I'll redeploy and check it again, thanks guys!
- borski 14y ago
  Yeah, that was totally our bad. I'm deploying the typo fix now. Let me know if you have any other issues! Happy to help.
  - scotje 14y ago
    See, in a very circular way I was just reporting the typo. :) (Looks good now that I have the right release deployed, by the way.)
    - borski 14y ago
      Ha, fair point. :) Glad you got it fixed!
bensedat 14y ago
We also are seeing a small group of apps with vulnerable applications even after upgrading to Rails 3.2.11, possibly due to a rogue middleware or other library. Disabling XML parsing entirely is one approach (see http://news.ycombinator.com/item?id=5035389 http://news.ycombinator.com/item?id=5035389) but we'd love to track it down further for everyone's good. Feel free to join us at https://www.tinfoilsecurity.com/chat https://www.tinfoilsecurity.com/chat if you'd like.

ScotterC 14y ago

Rails 3.2.1 or Rails 3.2.11. It has to be Rails 3.2.11 to get the patch

borski 14y ago

'bensedat seems to be hellbanned for some reason (Can a mod unhellban? He's definitely not a troll.) Anyway, echoing his comment: We also are seeing a small group of apps with vulnerable applications even after upgrading to Rails 3.2.11, possibly due to a rogue middleware or other library. Disabling XML parsing entirely is one approach (see http://news.ycombinator.com/item?id=5035389 http://news.ycombinator.com/item?id=5035389) but we'd love to track it down further for everyone's good. Feel free to join us at https://www.tinfoilsecurity.com/chat https://www.tinfoilsecurity.com/chat if you'd like.