The Evolution of Rails Security
summary
Chronicle of concrete incidents and fixes: a string of CVEs that include directory‑traversal leading to remote code execution, the GitHub mass‑assignment incident and its move to strong parameters, YAML/JSON deserialization RCE, logged‑payload render exploit, and lessons about sanitizers versus escaping. Tooling and changes that actually land: the static analyzer Brakeman, per‑form CSRF tokens, encrypted credentials and session cookies, default security headers, and a Content Security Policy DSL that exists but can be painfully hard to retrofit.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 2:06Rails History
- 2:31Rails 10 Release
- 2:41Rails 2006
- 8:06Rails 2007 5380
- 9:44Rails 2011
- 14:19Mass Assignment 2012
- 18:23Mass Assignment 2013
- 20:03Mass Assignment Part 2
- 21:47Log Traversal
- 22:46Sanitizing vs Escape
- 24:33Log Filtering
- 25:29Rails 30 Release
- 26:06Rails 31 Release
- 28:11Rails 40 Release
- 30:21Rails 40 Default headers
- 31:10Rails 50 Perform CSRF tokens
- 31:47Encrypted secrets
- 32:26Default headers
- 33:57Content Security Policy DSL
- 35:58Rails Security Guide
