Log for which keys values were set to nil in deep_munge #13813
Conversation
| @@ -1,3 +1,11 @@ | |||
| * Log which keys were affected by deep munge | |||
|
Seems a good plan to me. |
|
👍 |
|
@rafaelfranca @chancancode I fixed typos and made logs a little bit smarter, so i.e. |
|
@rafaelfranca @chancancode I added deep_munge description in guides. One mention is in action controller overview in "Hash and array parameters" section, second one is in security guide as "Unsafe query generation" chapter. I think it covers this well, I am not sure if this is in proper place when it comes to security guide. Output of command will look like: (new line here is made for better readibility) |
| @@ -112,6 +112,8 @@ NOTE: The actual URL in this example will be encoded as "/clients?ids%5b%5d=1&id | |||
|
|
|||
| The value of `params[:ids]` will now be `["1", "2", "3"]`. Note that parameter values are always strings; Rails makes no attempt to guess or cast the type. | |||
|
|
|||
| NOTE: Since `3.2.8` version of rails, values such as `[]`, `[nil]` or `[nil, nil, ...]` in params are replaced with `nil` for security reasons by default. See [Security Guide](security.html#unsafe-query-generation) for more information. | |||
There was a problem hiding this comment.
Should be "in params" since we are talking about the method. If we are talking about the parameters, it should be "in parameters"
There was a problem hiding this comment.
There is an extra space between the penultimate period and "See". Could you also wrap new additions around 80 chars please ? 😃
|
@rafaelfranca I corrected mistakes you pointed out and added mention in configuration guide. @robin850 Yeah, that line started to be very long ;) I changed it to multiline string. |
| @@ -112,6 +112,8 @@ NOTE: The actual URL in this example will be encoded as "/clients?ids%5b%5d=1&id | |||
|
|
|||
| The value of `params[:ids]` will now be `["1", "2", "3"]`. Note that parameter values are always strings; Rails makes no attempt to guess or cast the type. | |||
|
|
|||
| NOTE: Values such as `[]`, `[nil]` or `[nil, nil, ...]` in `params` are replaced with `nil` for security reasons by default. See [Security Guide](security.html#unsafe-query-generation) for more information. | |||
There was a problem hiding this comment.
Could you wrap your additions around 80 chars please ? The other guides aren't wrapped too. 😄
Also, this will need to be rebased. Thanks for the great work here so far! 👍
There was a problem hiding this comment.
Hey, thanks for heads up, is it ok now? :)
deep_munge solves CVE-2013-0155 security vulnerability, but its behaviour is definately confuisng. This commit adds logging to deep_munge. It logs keys for which values were set to nil. Also mentions in guides were added.
Log for which keys values were set to nil in deep_munge
|
Thank @lukesarnacki. Very good PR as always ❤️ |
|
Thanks @rafaelfranca :) |
I think we all want deep_munge to be gone soon, but I am afraid that we will have to wait little bit longer. There are many developers which are not aware of this behaviour so I thought that it would be nice of RoR if there was some kind of hint of what actually happened, so I added log message when value is set to
nilin deep_munge.I hope that with #13420 we will quickly make code from this PR go away, but in case it will take bit longer...
Any suggestions for better log message would be awesome.