Forgot your password?
typodupeerror

Comment oh. Wait, what? (Score 3, Insightful) 164

"Sadly Rails documentation doesn't warn you about this pitfall, but if you know anything at all about using SQL databases in web applications, you'd have heard of SQL injection, and it's not hard to come across warnings that find_by_sql method is not safe," Dmitry Borodaenko, a former production engineer at Facebook who brought the commit to my attention wrote in an email. "It is not 100% confirmed that this is the vulnerability that was used in the Gab data breach, but it definitely could have been, and this code change is reverted in the most recent commit that was present in their GitLab repository before they took it offline." Ironically, Fosco in 2012 warned fellow programmers to use parameterized queries to prevent SQL injection vulnerabilities.

So, this was the vulnerability, unless maybe it wasn't the vulnerability, because we don't know.

Also, Rails documentation absolutely does warn you about the ">pitfalls of using find_by_sql indiscriminately:

Ruby on Rails has a built-in filter for special SQL characters, which will escape ' , " , NULL character, and line breaks. Using Model.find(id) or Model.find_by_some thing(something) automatically applies this countermeasure. But in SQL fragments, especially in conditions fragments (where("...")), the connection.execute() or Model.find_by_sql() methods, it has to be applied manually.

User Journal

Journal Journal: Computer Programming Languages

I have spent years working with an assortment of programming languages - C, C++, Pascal/Delphi, Fortran, Ada, MS-DOS batch scripts (I didn't say all *good* languages), bash/csh scripts, SAS, PHP, Javascript...among others. Until recently I would have identified C++ as my "favorite" language. But that is changing.

Comment Re:Arch (Score 1) 5

I tried Fedora but I gave up on it when it repeatedly kernel-panicked on me. Wasn't fair, though - I was attempting to run it on a Sony laptop and Sony is notoriously Linux-unfriendly.

Bluestar is my first experience with Arch-based Linux. So far, so good...

User Journal

Journal Journal: [linux] BlueStar Linux 5

Yes, I'm still here. Yes, I know hardly anyone will read this. No, I don't especially care.

Recently I decided to change Linux disctributions on my main system and I installed BlueStar. It is an Arch-based distro which is a new experience for me; I have been using RedHat-based distros for ages, specifically Scientific. I wanted to try something new, and I ended up on BlueStar based on the reputation of Arch and based on a few reviews.

Slashdot Top Deals

A fanatic is a person who can't change his mind and won't change the subject. - Winston Churchill

Working...