diff options
| author | Andreas Scherer <andreas_coder@freenet.de> | 2009-02-18 16:13:48 +0100 |
|---|---|---|
| committer | Andreas Scherer <andreas_coder@freenet.de> | 2009-02-18 16:13:48 +0100 |
| commit | d9f037ea1f5075c283f5a66f0fc02114a7260c9a (patch) | |
| tree | b4d38e7d5e0ff8006ce7efa7b0014ec206e09e65 /railties/guides/source/security.textile | |
| parent | 791407d996d48a4d937ebb229cf2c2735816b016 (diff) | |
| download | rails-d9f037ea1f5075c283f5a66f0fc02114a7260c9a.tar.gz rails-d9f037ea1f5075c283f5a66f0fc02114a7260c9a.tar.bz2 rails-d9f037ea1f5075c283f5a66f0fc02114a7260c9a.zip | |
Sorry, wrong patch applied.
Diffstat (limited to 'railties/guides/source/security.textile')
| -rw-r--r-- | railties/guides/source/security.textile | 8 |
1 files changed, 2 insertions, 6 deletions
diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile index 066da15573..6b84ca1965 100644 --- a/railties/guides/source/security.textile +++ b/railties/guides/source/security.textile @@ -528,7 +528,7 @@ Ruby uses a slightly different approach than many other languages to match the e <ruby> class File < ActiveRecord::Base - validates_format_of :name, :with => /^[\w\.\-\+]+$/ # [1] + validates_format_of :name, :with => /^[\w\.\-\+]+$/ end </ruby> @@ -541,13 +541,9 @@ file.txt%0A<script>alert('hello')</script> Whereas %0A is a line feed in URL encoding, so Rails automatically converts it to "file.txt\n<script>alert('hello')</script>". This file name passes the filter because the regular expression matches – up to the line end, the rest does not matter. The correct expression should read: <ruby> -/\A[\w\.\-\+]+\z/ # [2] +/\A[\w\.\-\+]+\z/ </ruby> -fn1. Obviously, this regular expression gets rendered incorrectly by Textile. Could the original author please see into this? - -fn2. And this too, please. - h4. Privilege escalation -- _Changing a single parameter may give the user unauthorized access. Remember that every parameter may be changed, no matter how much you hide or obfuscate it._ |