From: dblack@... Date: 2006-11-01T09:10:56+09:00 Subject: Re: still more relentless non-repetition Hi -- On Wed, 1 Nov 2006, Giles Bowkett wrote: > On 10/31/06, Devin Mullins wrote: >> I'm too lazy ATM to read the whole thing and make a design >> recommendation, but Danger, Will Robinson! >> > eval("@#{params[:thing_to_search_for]}") = >> > (eval(params[:thing_to_search_for].capitalize)).find_by_contents @term >> Major Ruby-injection problem here. NEVER eval something you get from an >> untrusted user. Use, instead, instance_variable_get and Object.const_get. > > ah yeah, that's a good point, SQL injection attacks. It's not so much SQL injection as eval injection. Imagine if params[:thing_to_search_for] is "a=1; system('rm -rf /*')" or something. You'd be eval'ing the string: @a=1; system('rm -rf /*') David -- David A. Black | dblack@wobblini.net Author of "Ruby for Rails" [1] | Ruby/Rails training & consultancy [3] DABlog (DAB's Weblog) [2] | Co-director, Ruby Central, Inc. [4] [1] http://www.manning.com/black | [3] http://www.rubypowerandlight.com [2] http://dablog.rubypal.com | [4] http://www.rubycentral.org