SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)

[Kiopa_Matt]

anyone who things this exploit is a reasonable justification to use PHP instead doesn't have a god damn idea how to code, btw. PHP is and will be, for a long long time, a shitty, messy language.

Absolutely! Everyone on the internet is wrong, except you Ruby and Python enthusiasts. Most definitely.

 

[dchuk]

Absolutely! Everyone on the internet is wrong, except you Ruby and Python enthusiasts. Most definitely.

not what I'm saying. I would imagine every coder in this thread laughing at this Rails bug can't properly articulate why it's a bug or how it even works.

 

[amateursurgeon]

This tells you more about the risks of blindly trusting components you don't understand, than it does about Ruby or RoR.

There was a not dissimilar bug in PHP PDO a few years back, which affected any frameworks relying on it (read : all of them)

 

[mattseh]

not what I'm saying. I would imagine every coder in this thread laughing at this Rails bug can't properly articulate why it's a bug or how it even works.

what is a method sig and how can i has multiple?

 

[crackp0t]

This tells you more about the risks of blindly trusting components you don't understand, than it does about Ruby or RoR.

There was a not dissimilar bug in PHP PDO a few years back, which affected any frameworks relying on it (read : all of them)

My comment was actually sarcastic. I agree with you.

 

[igl00]

dynamic finders were cooler tho

 

[pbakos92]

Good explanation of the bug: Rails SQL injection vulnerability: hold your horses, here are the facts

 

[yast]

another one:

https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion

Analysis of Rails XML Parameter Parsing Vulnerability - Insinuator

Disclaimer: i don't post these to start a flaming war, but to point them out to whom it may concern and missed them, since a lot of peeps here run RR apps.