Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I agree with you that this is not a Rails bug.

But I disagree that Homakov's hack "only demonstrated a mistake on Github's part." It rebutted the Rails team opinion (and again, not all of them disagreed with Homakov) that this was a trivial, edge-case problem.

IIRC, one of the changes in Rails 3 was that interpolation in ERb templates were html sanitized by default: http://stackoverflow.com/questions/4731992/rails-3-how-to-re...

The fact that web devs write templates vulnerable to XSS is not Rails fault, but apparently the problem was prevalent enough that HTML sanitizing was turned on by default.

Apparently, there wasn't empirical evidence to show that update_attributes had the same rate of mistakes to justify a change in defaults...Homakov's hack was a powerful rebuttal.



I think you're right that this is a problem, and I would support changing the default, although I can understand why they don't.

You make a good point that showing a hugely popular app with mistake X suggests that mistake X should be prevented at the framework level.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: