diff --git a/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb b/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb index 4c2bdc6..076fab2 100755 --- a/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb +++ b/app/views/layouts/tutorial/misconfig/_misconfig_first.html.erb @@ -16,7 +16,7 @@
- Under progress... + Security misconfiguration can happen at any level of an application stack, including the platform, web server, application server, database, framework, and custom code. Developers and system administrators need to work together to ensure that the entire stack is configured properly. Automated scanners are useful for detecting missing patches, misconfigurations, use of default accounts, unnecessary services, etc.
@@ -30,7 +30,15 @@
- Under progress... +

Rails has quite a few security related configurations. One of which relates to enforcing mass assignment protection.

+

+ 

+            <%= %q{
+              config.active_record.whitelist_attributes=false
+            } %>
+
+

+

This configuration forces an application developer to whitelist attributes that can be modified with mass-assignment. When this configuration is set to false any attribute can be mass-assigned.

@@ -44,7 +52,14 @@
- Under progress... + The solution for this issue is quite simple. In your application.rb file set the configuration as follows. + 
+            <%= %q{
+              config.active_record.whitelist_attributes=true
+            } %>
+
+ Once this configuration is updated to true and the application is restarted, any attributes to be mass-assigned will have to be defined as attr_accessible. +

@@ -58,7 +73,7 @@
- Under progress... + It has to do with mass-assignment, whitelisting and configuration.
diff --git a/app/views/layouts/tutorial/misconfig/_misconfig_second.html.erb b/app/views/layouts/tutorial/misconfig/_misconfig_second.html.erb new file mode 100644 index 0000000..db874d7 --- /dev/null +++ b/app/views/layouts/tutorial/misconfig/_misconfig_second.html.erb @@ -0,0 +1,80 @@ +
+
+
+ A6 - Security Misconfiguration +
+
+
+
+
+
+ + + + Description + +
+
+
+ Another one of the Rails security configurations relates to escaping HTML entities in JSON. +
+
+
+
+
+ + + + Bug + +
+
+
+

When the following setting is set to false, HTML entities in JSON response will not be encoded.

+

+ 

+            <%= %q{
+              ActiveSupport::escape_html_entities_in_json = false
+            } %>
+
+

+
+
+
+
+
+ + + + Solution + +
+
+
+

Edit the html_entities file at config/initializers/html_entities.rb and set the following to true.

+ 

+            <%= %q{
+              ActiveSupport::escape_html_entities_in_json = true
+            } %>
+

+

Once the initializer is edited and the application is restarted, any HTML entities in JSON responses will be encoded.

+
+
+
+
+
+ + + + Hint + +
+
+
+ Think HTML entities, escaping and initializers. +
+
+
+
+
+
\ No newline at end of file diff --git a/app/views/tutorials/misconfig.html.erb b/app/views/tutorials/misconfig.html.erb index da9c0fc..e7cf527 100755 --- a/app/views/tutorials/misconfig.html.erb +++ b/app/views/tutorials/misconfig.html.erb @@ -5,6 +5,11 @@ <%= render :partial => "layouts/tutorial/misconfig/misconfig_first"%> +
+
+ <%= render :partial => "layouts/tutorial/misconfig/misconfig_second"%> +
+
diff --git a/config/application.rb b/config/application.rb index 1d45be7..700c154 100755 --- a/config/application.rb +++ b/config/application.rb @@ -40,7 +40,7 @@ module Railsgoat config.filter_parameters += [:password] # Enable escaping HTML in JSON. - config.active_support.escape_html_entities_in_json = false + #config.active_support.escape_html_entities_in_json = false # Use SQL instead of Active Record's schema dumper when creating the database. # This is necessary if your schema can't be completely dumped by the schema dumper, diff --git a/config/initializers/html_entities.rb b/config/initializers/html_entities.rb new file mode 100644 index 0000000..a4df94a --- /dev/null +++ b/config/initializers/html_entities.rb @@ -0,0 +1 @@ +ActiveSupport::escape_html_entities_in_json = false