Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

[SECURITY] use taint/untaint before execution of custom sql

#2

Using ruby's tain/untaint mechanism could ensure that we never get "dirty" strings in the SQL.

Everything is carefully quoted, "to_i" or protected using connection.quote(), so it should not be too hard to implement and make sure "to_i", connection.quote and other clearing methods "untaint".

Reported by Gaspard Bucher · September 3rd, 2008 @ 12:44 PM

State: open
Milestone: 1.0
Assigned to: Gaspard Bucher Gaspard Bucher

Activity

  1. Gaspard Bucher
    Gaspard Bucher
    • Milestone set to 1.0

    September 3rd, 2008 @ 02:54 PM

  2. Gaspard Bucher
    Gaspard Bucher
    • Tag changed from critical, zena to zena

    It's not that critical. Do not use this tag unless it's getting really really hot.

    September 29th, 2008 @ 05:58 PM

  3. Gaspard Bucher
    Gaspard Bucher
    • Tag changed from zena to security, zena

    May 18th, 2010 @ 09:47 AM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.