Security Risks On Rails: Misconfiguration and Unsafe Integrations

• railsgoat

  2 854 0.0 HTML

  A vulnerable version of Rails that follows the OWASP Top 10

  

As with the other articles, RailsGoat will be used to explore some aspects of these threats in practice. If you're new here, please refer to the previous two articles to get the app set up and get acquainted with what we’ve explored so far. Let's jump right in!

• protected_attributes

  1 230 0.0 Ruby

  Protect attributes from mass-assignment in ActiveRecord models.

  

If you’re migrating from Rails 3 to a newer version and still don’t want to deal with that specific part, Rails still allows the use of the protected_attributes gem for a smoother upgrade path, but be mindful that this is just until version 5. From there on, no more support will be provided.

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• Ruby on Rails

  467 54,936 10.0 Ruby

  Ruby on Rails

  

This allows Rails to escape any HTML content in JSON responses, which is great. Make sure to always double-check whether the value is set to true since there’s some controversy about the default value, depending on the version of Rails.

• Reek

  6 3,980 8.1 Ruby

  Code smell detector for Ruby

Other useful gems you may take a look at are dawnscanner, reek, and hakiri_toolbelt.

• bundler-audit

  5 2,645 6.1 Ruby

  Patch-level verification for Bundler

  

Let’s take the super famous gem bundler-audit, for instance. It works closely with bundler to provide patch-level verification for your project gems, such as vulnerability checks, insecure gem sources, etc.

• Brakeman

  16 6,911 7.5 Ruby

  A static analysis security vulnerability scanner for Ruby on Rails applications

Another great lib for this is Brakeman, which can be installed in a very similar process and gives you even more detailed reports:

• dawnscanner

  2 729 4.6 Ruby

  Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.

Other useful gems you may take a look at are dawnscanner, reek, and hakiri_toolbelt.

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

• Hakiri

  1 268 0.0 Ruby

  Secure Ruby apps with Hakiri

  

Other useful gems you may take a look at are dawnscanner, reek, and hakiri_toolbelt.

Suggest a related project