From: Dido Sevilla <dido.sevilla@...>
Date: 2006-06-01T15:07:08+09:00
Subject: Re: Ruby security question

On 6/1/06, Jeff Pritchard <jp@jeffpritchard.com> wrote:
> Is this the same as thinking one is safe from viruses because he's
> driving a Macintosh, or is Ruby (and any other ducktyped and garbage
> collected, etc. etc. language) automatically much safer by default?
>

Yes and no. The main thing with scripting languages like Ruby is that
insecure programming practices lead to different, and higher-level
classes of bugs than your garden-variety buffer overflow. You probably
won't be able to write a Ruby program that is vulnerable to buffer
overflows unless there is such a bug in Ruby itself (highly unlikely)
or within an extension library you're using (most of them tend to
themselves be written in C). However, there are other classes of
security bugs that affect these kinds of languages. Take for example
SQL injection attacks. These happen because a program foolishly
constructs an SQL query using raw data input from an untrusted
source. For example, if we had some Ruby-DBI code that did the
following:

sql = "SELECT * FROM usertable WHERE user='#{username}'";
result = @dbh.select_one(sql)

where username is obtained from, say, a web form, what happens if
username happens to be something like "'; DELETE FROM usertable; '"?
The moral of the story is to never use any data coming in from
untrusted sources without validating it first, and Ruby has (like
Perl) a notion of tainted data that allows one to defend against this
problem. If your $SAFE mode is set high enough, in the above example,
username would be considered tainted, and the construction of the SQL
statement would have caused a tainted data exception, alerting you to
the problem before it becomes an issue. I would have to validate
username first by passing it through a regex before I could use it in
that way.