Rails - Aug 2006 - Scaffolding Extensions Plugin Security Update (with New Features)

I just wanted to let everyone know that I found a major security
problem with the Scaffolding Extensions plugin that I develop.  There
is an SQL injection vulnerability in the search results function due
to lack of sanitation of user input.  If you are using the plugin and
allowing public access to the search feature it provides, I highly
recommend you update the plugin as soon as possible.

The vulnerability is trivial to exploit as evidenced by the following code:

  params[:null].each {|field| conditions[0] <<
#{class_name}.table_name + ''.'' + field + '' IS
NULL'' } if params[:null]
  params[:notnull].each {|field| conditions[0] <<
#{class_name}.table_name + ''.'' + field + '' IS NOT
NULL'' } if
params[:notnull]

The latest revision of the plugin, which fixes this vulnerability, is
available at:

  svn: svn://suven.no-ip.org/rails/plugins/scaffolding_extensions
  file: http://suven.no-ip.org/scaffolding_extensions.tar.gz

I found this bug as I was finishing up a bunch of new features for the
plugin (which are also included in the latest revision), such as:

1) Pagination of the search results
2) Only update attributes specified in the scaffold (no need for
attr_protected or attr_accessible)
3) Allow outputing the code generated by the scaffold method instead
of evaluating it (a poor man''s generator)
4) Allow choosing the visible name for each attribute
5) Use HTML label tags in forms
6) Specify different fields used for each scaffold type (i.e. some
fields can be shown but are not editable)
7) Add some testing code that allows for limited testing of the plugin
in your environment
8) Various bug fixes and minor enhancements

I apologize for the serious vulnerability this plugin exposed,
especially since the vulnerability is fairly obvious just by looking
at the code.  I''ll be more diligent in the future.

Jeremy

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---