Secure Programming with Ruby on Rails
summary
An analysis of roughly 26,000 Ruby on Rails repositories using Brakeman, Don Scanner and Google BigQuery finds many false positives but real vulnerabilities including widespread mass-assignment (~22,000 Brakeman flags), SQL injection, file/command injection, and hard-to-exploit deserialization RCEs discovered via gadget searches. The recommended approach is regular updates, automated scanning combined with targeted code reviews.
AI-written summary · about
chapters (13)
- 0:00Rails security intro
- 1:12Research method and data
- 2:15Automated security analysis
- 6:04GitHub Rails security
- 12:28Rails security features and risks
- 17:21Rails vulnerabilities 2013/2014
- 23:19Ruby gems security issues
- 25:50Automated scan results
- 34:20XSS and session flaws
- 37:52DoS and file access flaws
- 41:08Input validation and injection
- 42:54Password and auth risks
- 44:02Conclusion
related talks
37mThe Evolution of Rails Security
36mSecurity is hard, but we can't go shopping
31mRails Application Security in Practice
34mThe World of Rails Security
42mSecuring Your Rails App
31mRails' Insecure Defaults
40mSecurity Is Hard, But We Can't Go Shopping
20mDefending Against Data Breaches, as a Practicing Ruby Developer