CODEWITHSUNDEEP
ruby-on-railsruby-on-rails-3denial-of-service
Dipak Panchal
Dipak Panchal

Reputation: 6036

Getting warning : Denial of Service

Customer.find(:all, :select => 'id', :order => 'updated_at DESC', :readonly => true, :conditions => { :status_id => Customer.id_for_status(params[:id].to_sym) }, :offset => offset, :limit => 30).collect(&:id)

Above is my query in that I am getting warning like

Symbol conversion from unsafe string (parameter value) near line 33: params[:id].to_sym

This is the warning of Denial of Service. Anybody have any idea how can I fix this warning?

Thanks In Advance

Upvotes: 1

Views: 1059

Answers (1)

knagode
knagode

Reputation: 6125

The problem here is params[:id].to_sym

When the string which would be converted to symbol is an open set, you should NOT convert them into symbols. Each symbol created will not be garbage collected, and could create potential memory leak which makes your system vulnerable to Dos attacks.

Problem was resolved in Ruby 2.2. but still - rather white list anything that would be converted into symbols.

Upvotes: 4

Related Questions