Ruby Hero Awards 2011

Ruby Heroes

It’s that time again to take a moment to think about those who have impacted the Ruby community this year but have not received the recognition they deserve. We have given away eighteen awards in the past three years at Railsconf, and this year we are preparing to give away six more.

But we need your help.

So, if you know someone who has contributed greatly this year please take a moment to show some gratitude by nominating them on RubyHeroes.com. In two weeks the Ruby Heroes from last year will look at the nominations and decide who should receive the awards (this way there’s no popularity contest). However, your nominations do matter, so please take a moment and spread the gratitude.

The winners will be announced live on stage at Railsconf 2011.

Rails 3.0.6 has been released!

Hi everybody! Rails 3.0.6 has been released!

Let’s get the serious business out of the way first:

Rails 3.0.6 contains an important security fix! Please upgrade!

Rails versions 3.0.x prior to 3.0.6 contain an XSS vulnerability. The vulnerability manifests itself via the auto_link method. The auto_link method will automatically mark input strings as “html safe” even if the input is from an unknown origin.

For example:

<%= auto_link(params[:content]) %>

If the “content” parameter contains malicious javascript, that script will be rendered without being escaped.

How can I protect myself?

  • Upgrade to Rails 3.0.6, then content passed to auto_link will be automatically escaped for you.

  • If you cannot upgrade Rails, then apply the patch found here. Then auto_link content will be escaped for you.

  • If you cannot upgrade Rails, or apply the patch, then change your calls to auto_link to call sanitize like so:

    <%= sanitize(auto_link(params[:content])) %>

    If you trust the input, then change to this

    <%= raw(auto_link(params[:content])) %>

Credits

Thanks go to Torben Schulz for reporting this issue!

SERIOUS BUSINESS COMPLETE

After two release candidates, we we we so excited to announce the release of Rails version 3.0.6! I want to thank everyone that tried out the release candidates and reported their feedback! I hope that we can continue soliciting feedback from the public before releasing final versions.

LOL CHANGES!!!!

For changes in a particular package, please view the CHANGELOG in each particular project on github. Even better, you can check the compare view.

Changes of note are:

  • The above security fix in ActionPack 61ee3449674c591747db95f9b3472c5c3bd9e84d

  • Un-deprecating the reorder method in ActiveRecord 235a4142aa3fee73faa0f01e267a2b4254cea8ce

  • A backport of “cheaper attributes reads” in ActiveRecord 86acbf1cc050c8fa8c74a10c735e467fb6fd7df8

  • Correctling handling before_type_cast on timezone aware attributes 0823bbd757f3654a08d300e27873758da606f06a

  • Escaping binary data in sqlite3 inserts 7222786c15eacbd432b2bce9798d3f3459f7e05f

  • Fixing schema support for the mysql adapter eb1eac93151c1d45c3ef292d99bfcf74799185ea

This change list IS NOT exhaustive. They are just some of my favorites! For the complete list please see the CHANGELOG files or view the diff on github.

GEM CHECKSUMS

If you totally want to make sure that you’ve got the right gems, here are my shasums before I pushed the gems!

shasum *

  • fc7b0503bdf99d1ec08dc0dcee3677ca1dd29f0f actionmailer-3.0.6.gem
  • e8fbefd5b0a46408dd557331700ea514a4c199ab actionpack-3.0.6.gem
  • 8509520744ecd8e6712158311a16ba4782b454e2 activemodel-3.0.6.gem
  • 3b392e811ba342a5bf430d89cf4f060d119aba64 activerecord-3.0.6.gem
  • 9eea440bdf885e857ebfb5ff8e31119f76a18a4e activeresource-3.0.6.gem
  • 175ba6286f7802edeeaab30f900d87a38f516728 activesupport-3.0.6.gem
  • ebeea3c1f03db3309ea9a6640e1767ab144ff567 rails-3.0.6.gem
  • 61e24f94ea87fc58175b2067f7f6a3a8c468bfe0 railties-3.0.6.gem

IN CLOSING

Thank you for waiting for me to finish vacation before I released this! I hope that everyone enjoys this bugfix release of Rails. Next time I’ll try not to vacation so much! ;-)

<3 <3 <3 <3 <3

Rails 3.0.5 has been released!

Aaron Patterson showed us some tenderlove this week by releasing Rails 3.0.5. Have a peek at what got updated.

Bugs Fixed

  • Fix when gzip returns a UTF-8 string on Ruby 1.9, when it is actually binary. commit
  • Active Record limit values will not escape Arel SQL Literal nodes. commit
  • Relation#where calls will always produce AND statements regardless of how conditions hashes behaves (reverting 00693209ecc).
  • Observer callbacks will only be executed once when using STI classes in ActiveRecord. commit

Deprecations Added:

  • Deprecate Relation#& alias for Relation#merge. commit
  • Deprecated support for interpolated association conditions with the
    :conditions => ‘foo = #{bar}’ syntax, and added the new interpolation syntax
    which is :conditions => proc { “foo = #{bar}” }. commit

This is not a complete list of changes. The complete list of changes can be
found here

SHA1 Checksums:

  • actionmailer-3.0.5.gem b25750c8126aa21db27d7b0ee829b2e94e525ebc
  • actionpack-3.0.5.gem 0a6f7f9ac2960ff224c913877a2917e1bea80df3
  • activemodel-3.0.5.gem 1556900a7afa1cdcdf4641edbcdd2c24f98bb2de
  • activerecord-3.0.5.gem 33dd05d7362931564f6f15ea7130cc27a5fc09e8
  • activeresource-3.0.5.gem 758f893cbb7ef945c857bf4ca044b94017bdc437
  • activesupport-3.0.5.gem 195fa3f7fa044134703a655cdb906edb515286c4
  • rails-3.0.5.gem 32322bf9952d76c5fa0054c8533c0c58609f40aa
  • railties-3.0.5.gem 3dddf14736dec991c3dbbe2d89495613e72c19c7

CSRF Protection Bypass in Ruby on Rails

There is a vulnerability in Ruby on Rails which could allow an attacker to circumvent the CSRF protection provided. This vulnerability has been assigned the CVE Identifier CVE-2011-0447.

  • Versions Affected: 2.1.0 and above
  • Not affected: Applications which don’t use the built in CSRF protection.
  • Fixed Versions: 3.0.4, 2.3.11

Impact

Certain combinations of browser plugins and HTTP redirects can be used to trick the user’s browser into making cross-domain requests which include arbitrary HTTP headers specified by the attacker. An attacker can utilise this to spoof ajax and API requests and bypass the built in CSRF protection and successfully attack an application. All users running an affected release should upgrade or apply the patches immediately.

Releases

The 3.0.4 and 2.3.11 releases are available at the normal locations.

Upgrade Process

There are two major changes in this fix, the behaviour when CSRF protection fails has changed and the token will now be required for all non-GET requests.

After applying this patch failed CSRF requests will no longer generate HTTP 500 errors, instead the session will be reset. Users can override this behaviour by overriding handle_unverified_request in their own controllers.

Users must still take care that users cannot be auto logged in via non-session data. For example, an application using filters to implement ‘remember me’ functionality must either remove those cookies in their handle_unverified_request handlers or ensure that the remember me code is only executed on GET requests. A custom handler which removes the remember_me cookie would look like:

def handle_unverified_request super # call the default behaviour which resets the session cookies.delete(:remember_me) # remove the auto login cookie so the fraudulent request is rejected. end

There are two steps to ensuring that your application sends the CSRF Token with every ajax request. Providing the token in a meta tag, then ensuring your javascript reads those values and provides them with each request. The first step involves you including the csrf_meta_tag helper somewhere in your application’s layout. Rails 3 applications likely already include this helper, however it has now been backported to the 2.3.x series. An example of its use would be something like this in application.html.erb:

<%= javascript_include_tag :defaults %> <%= csrf_meta_tag %>

In addition to altering the templates, an application’s javascript must be changed to send the token with Ajax requests. Rails 3 applications can just update their rails.js file using rake rails:update, 2.x applications which don’t use the built-in ajax view helpers will need to add a framework-specific snippet to their application.js. Examples of those snippets are available:

Workarounds

There are no feasible workarounds for this vulnerability.

Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format, 3-0-csrf.patch includes two changesets, the others consist of a single changeset.

Given the severity of the problem we are also providing backported fixes to the 2.2 and 2.1 series. There will be no gem releases for these versions but the stable branches in git will be updated.

Please note that only the 2.3.x and 3.0.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee continued security fixes indefinitely.

Credits

Thanks to Felix Gröbert of the Google Security Team for reporting the vulnerability to us and working with us to ensure that the fix didn’t introduce any new issues. Thanks also to the Shopify development team for their assistance in verifying the fix and the upgrade process. The original vulnerability has been reported to vendors by kuza55

New Releases: 2.3.11 and 3.0.4

Two new versions of Ruby On Rails have been released today. As well as including a number of bugfixes they contain fixes for some security issues. The full details of each of the vulnerabilities are available on the rubyonrails-security mailing list. We strongly urge you to update production Rails applications as soon as possible. Rather than post the advisories individually to this blog, I’ll just link to the google talk archives.

Install the latest version using gem install rails. Or if you’re using bundler, edit your gemfile and run bundle update rails.

Summaries

Affecting 2.×.x and 3.0.x

  • XSS Risk in mail_to :encode=>:javascript”:http://groups.google.com/group/rubyonrails-security/t/f02a48ede8315f81 CVE-2011-0446
  • CSRF Bypass Risk CVE-2011-0447

Affecting 3.0.x only

Conferences for 2011

One of the reasons the Ruby and Rails community is so strong and passionate is because of the awesome regional conferences that happen all around the globe on a yearly basis. Previously on this blog I’ve gone through the list and highlighted a bunch, but since then Ruby There has popped up.

So instead of listing out all the conferences I’m just going to send you over to RubyThere.com.

If you dig the Ruby and Rails community I highly recommend you attend one of these events and maybe volunteer to help or even sponsor if you can afford to. It’s hard work putting on a conference, and most of the organizers do it for the love of the community (and little to no compensation).

Rails for Zombies

This morning my team over at Envy Labs released a free online tutorial called Rails for Zombies. The website combines screencasts with in-browser coding to provide an interactive learning experience teaching the basics of Ruby on Rails.

Rails for Zombies

Learning Rails for the first time should be fun, and Rails for Zombies allows you to get your feet wet without any setup or configuration. At the moment the application has five episodes. Each episode consists of a single screencast followed by a group of exercises which must be completed before moving forward. Once you complete all the labs, you unlock a hidden video which shows you where to go to continue your Rails learning.

If you have any friends who need to get started with Rails, hopefully this will help.

Rails 3.0.3: Faster Active Record plus fixes

How about some free speed? Well, here you go. Rails 3.0.3 includes a much faster version of Active Record that reclaims the performance lost when we went from Rails 2.3.x to 3.x and then some. Aaron Patterson has done a phenomenal job benchmarking, tweaking, and tuning the ARel engine that underpins Active Record 3 and the result is Teh Snappy.

You can read more about Aaron’s work in his ARel 2.0 write-up. If you dare, you can also have a look at his RubyConf slides that went over the rewrite and speed-up in even greater detail (warning: there are slides of boys kissing!).

In addition to the free speed, we’ve also included a truckload of minor fixes. So everything just works better and faster. What more can you ask for? Oh, that it’s a drop-in replacement for Rails 3.0 — there are no API changes. You got it.

See all the changes on Github. Install the latest version using gem install rails. Or bind yourself to the v3.0.3 tag.

Enjoy!

Note: Active Record 3.0.3 is mistakenly reporting its tiny version as 1 instead of 3. This has no impact on anything you do unless you were specifically checking that tiny version. But if it bothers you lots, it’s fixed on the 3-0-stable branch.

Security Vulnerability in Nested Attributes code in Ruby On Rails 2.3.9 and 3.0.0

There is a vulnerability in the nested attributes handling code in some versions of Ruby on Rails. An attacker could manipulate form parameters and make changes to records other than those the developer intended. This vulnerability has been assigned the identifier CVE-2010-3933.

  • Versions Affected: 3.0.0, 2.3.9
  • Not affected: Versions earlier than 2.3.9 and applications which do not use accepts_nested_attributes_for
  • Fixed Versions: 3.0.1, 2.3.10

Impact

An attacker could change parameter names for form inputs and make changes to arbitrary records in the system. All users running an affected release should upgrade immediately.

Releases

The 3.0.1 and 2.3.10 releases are available at the normal locations. The 3.0.1 release consists solely of 3.0.0 with the security issue fixed, 3.0.2 will follow shortly and include other bugfixes as well as this fix. 2.3.10 is a regular release in the 2.3 series.

Workarounds

There are no feasible workarounds for this issue.

Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

Please note that only the 2.3.x and 3.0.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible.

Credits

Thanks to Matti Paksula and Juha Suuraho of Enemy & Sons Ltd for reporting the vulnerability to us and helping verify the fix.