From: gabriele renzi <surrender_itRemove@...>
Date: 2006-08-11T05:10:18+09:00
Subject: Re: [ANN] Rails 1.1.6: Stronger fix, backports, and full disclosure

David Heinemeier Hansson ha scritto:
> The cat is out of the bag, so here's the full disclosure edition of
> the current security vulnerability. With Rails 1.1.0 through 1.1.5
> (minus the short-lived 1.1.3), you can trigger the evaluation of Ruby
> code through the URL because of a bug in the routing code of Rails.
> This means that you can essentially take down a Rails process by
> starting something like /script/profiler, as the code will run for a
> long time and that process will be hung while it happens. Other URLs
> can even cause data loss.

it is nice to see this kind of quick feedback and bugfix, but I wonder 
if this coulkd have been avoided from the start by using $SAFE, someone 
has ever investigated if rails can be made to run with higher safe 
levels than 0 ?