From b7bc1d5d2b4e47443a84c5327d7a748df694a951 Mon Sep 17 00:00:00 2001 From: Lucia Date: Tue, 29 Aug 2017 17:22:50 +0800 Subject: [PATCH 1/7] add authenticity_token to form --- app/controllers/application_controller.rb | 2 +- app/helpers/users_helper.rb | 8 +++++--- app/views/events/show.html.erb | 6 +++--- config/routes.rb | 2 +- 4 files changed, 10 insertions(+), 8 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 682a07d..cd6ea53 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,6 +1,6 @@ class ApplicationController < ActionController::Base - # protect_from_forgery with: :exception + protect_from_forgery with: :exception helper_method :current_cart diff --git a/app/helpers/users_helper.rb b/app/helpers/users_helper.rb index ed49051..b9ecfaf 100644 --- a/app/helpers/users_helper.rb +++ b/app/helpers/users_helper.rb @@ -7,9 +7,11 @@ def user_avatar_link(user) email_md5 = Digest::MD5.hexdigest(user.email) gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}" - str = "
" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
" - - str.html_safe + # str = "
" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
" + # + # str.html_safe + "
".html_safe + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "
".html_safe + end end diff --git a/app/views/events/show.html.erb b/app/views/events/show.html.erb index 0e89067..2996fec 100644 --- a/app/views/events/show.html.erb +++ b/app/views/events/show.html.erb @@ -22,14 +22,14 @@
- <%= raw comment.content %> + <%= sanitize comment.content %>
<%= comment.created_at.to_s %> <% if current_user && current_user.is_admin? %> - <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :class => "btn btn-default" %> + <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :method => :post, :class => "btn btn-default" %> <% end %> <% if comment.can_deleted_by(current_user) %> @@ -50,4 +50,4 @@
<%= f.submit "Comment", :class => "btn btn-primary" %>
-<% end %> \ No newline at end of file +<% end %> diff --git a/config/routes.rb b/config/routes.rb index 2cfd938..a5ccf3e 100644 --- a/config/routes.rb +++ b/config/routes.rb @@ -7,7 +7,7 @@ resources :events do resources :comments do member do - get :highlight + post :highlight end end end From 26b0ca6569f1b8842c465f4ddea7c29aab8a9bfa Mon Sep 17 00:00:00 2001 From: Lucia Date: Tue, 29 Aug 2017 17:57:40 +0800 Subject: [PATCH 2/7] SQL injection --- app/controllers/events_controller.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/app/controllers/events_controller.rb b/app/controllers/events_controller.rb index 245dece..995923f 100644 --- a/app/controllers/events_controller.rb +++ b/app/controllers/events_controller.rb @@ -9,10 +9,12 @@ def show @comments = @event.comments if params[:keyword] - @comments = @comments.where( "comments.content LIKE '%#{params[:keyword]}%'") + keyword = ActiveRecord::Base::connection.quote_string( params[:keyword] ) + # @comments = @comments.where("comments.content LIKE ?", "%#{params[:keyword]}") + @comments = @comments.where( "comments.content LIKE '%#{keyword}%'") end - if params[:sort] + if params[:sort] && ["id DESC", "id ASC"].include?(params[:sort]) @comments = @comments.order(params[:sort]) end From f6116e45118bc46129eb5f80fecdcb89c0b07906 Mon Sep 17 00:00:00 2001 From: Lucia Date: Tue, 29 Aug 2017 18:21:08 +0800 Subject: [PATCH 3/7] hacker cannot change the role params --- app/controllers/users_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index f1d232d..fd6cac4 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -21,7 +21,7 @@ def update protected def user_params - params.require(:user).permit(:nickname, :role) + params.require(:user).permit(:nickname) end end From 16cb9457c920dd726ab9e37b9eb77edbf17b870a Mon Sep 17 00:00:00 2001 From: Lucia Date: Tue, 29 Aug 2017 19:13:31 +0800 Subject: [PATCH 4/7] install rack-attack to project --- Gemfile | 1 + Gemfile.lock | 3 +++ config/application.rb | 4 +++- config/initializers/rack-attack.rb | 18 ++++++++++++++++++ 4 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 config/initializers/rack-attack.rb diff --git a/Gemfile b/Gemfile index e91c3ae..2edbe10 100644 --- a/Gemfile +++ b/Gemfile @@ -32,6 +32,7 @@ gem 'jquery-rails' gem 'turbolinks', '~> 5' # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder gem 'jbuilder', '~> 2.5' +gem 'rack-attack' # Use Redis adapter to run Action Cable in production # gem 'redis', '~> 3.0' # Use ActiveModel has_secure_password diff --git a/Gemfile.lock b/Gemfile.lock index 30c443b..8ba62cd 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -98,6 +98,8 @@ GEM orm_adapter (0.5.0) puma (3.8.2) rack (2.0.1) + rack-attack (5.0.1) + rack rack-test (0.6.3) rack (>= 1.0) rails (5.0.2) @@ -200,6 +202,7 @@ DEPENDENCIES jquery-rails listen (~> 3.0.5) puma (~> 3.0) + rack-attack rails (~> 5.0.2) rspec-rails sass-rails (~> 5.0) diff --git a/config/application.rb b/config/application.rb index 2d9ee51..4c67fe3 100644 --- a/config/application.rb +++ b/config/application.rb @@ -16,4 +16,6 @@ class Application < Rails::Application end end -Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d') \ No newline at end of file +Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d') + +config.middleware.use Rack::Attack diff --git a/config/initializers/rack-attack.rb b/config/initializers/rack-attack.rb new file mode 100644 index 0000000..ff6b690 --- /dev/null +++ b/config/initializers/rack-attack.rb @@ -0,0 +1,18 @@ +class Rack::Attack + + throttle('req/ip', :limit => 180, :period => 1.minute) do |req| + req.ip + end + + throttle('logins/ip', :limit => 5, :period => 20.seconds) do |req| + if req.path == '/users/sign_in' && req.post? + req.ip + end + end + + throttle('logins/email', :limit => 5, :period => 20.seconds) do |req| + if req.path == '/users/sign_in' && req.post? + req.params['email'].presence + end + end +end From f1e6786e778050bbfd888fac73ab9fd6d1fe9f8c Mon Sep 17 00:00:00 2001 From: Lucia Date: Tue, 29 Aug 2017 19:36:51 +0800 Subject: [PATCH 5/7] use rack-attack for throttling abusive requests --- config/application.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/config/application.rb b/config/application.rb index 4c67fe3..a91e2c8 100644 --- a/config/application.rb +++ b/config/application.rb @@ -8,6 +8,7 @@ module RailsRecipes class Application < Rails::Application + config.middleware.use Rack::Attack # Settings in config/environments/* take precedence over those specified here. # Application configuration should go into files in config/initializers # -- all .rb files in that directory are automatically loaded. @@ -17,5 +18,3 @@ class Application < Rails::Application end Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d') - -config.middleware.use Rack::Attack From d227f53268676891d230e970bcbc4f4903162df2 Mon Sep 17 00:00:00 2001 From: Lucia Date: Tue, 29 Aug 2017 19:44:04 +0800 Subject: [PATCH 6/7] install brakeman to project --- Gemfile | 2 ++ Gemfile.lock | 2 ++ 2 files changed, 4 insertions(+) diff --git a/Gemfile b/Gemfile index 2edbe10..3bd6aaa 100644 --- a/Gemfile +++ b/Gemfile @@ -43,6 +43,8 @@ gem 'rack-attack' group :development, :test do gem 'rspec-rails' + gem 'brakeman' + # Call 'byebug' anywhere in the code to stop execution and get a debugger console gem 'byebug', platform: :mri end diff --git a/Gemfile.lock b/Gemfile.lock index 8ba62cd..4dc0bf1 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -46,6 +46,7 @@ GEM bootstrap-sass (3.3.7) autoprefixer-rails (>= 5.2.1) sass (>= 3.3.4) + brakeman (3.7.2) builder (3.2.3) byebug (9.0.6) coffee-rails (4.2.1) @@ -194,6 +195,7 @@ PLATFORMS DEPENDENCIES bootstrap-sass + brakeman byebug coffee-rails (~> 4.2) devise From 0ea7077cc0a0036d65c63bfb59da69309b64e679 Mon Sep 17 00:00:00 2001 From: Lucia Date: Tue, 29 Aug 2017 19:45:56 +0800 Subject: [PATCH 7/7] install bundler-audit and fixed nokogiri --- Gemfile | 2 +- Gemfile.lock | 10 +++++++--- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/Gemfile b/Gemfile index 3bd6aaa..e766ced 100644 --- a/Gemfile +++ b/Gemfile @@ -44,7 +44,7 @@ gem 'rack-attack' group :development, :test do gem 'rspec-rails' gem 'brakeman' - + gem 'bundler-audit' # Call 'byebug' anywhere in the code to stop execution and get a debugger console gem 'byebug', platform: :mri end diff --git a/Gemfile.lock b/Gemfile.lock index 4dc0bf1..59d6371 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -48,6 +48,9 @@ GEM sass (>= 3.3.4) brakeman (3.7.2) builder (3.2.3) + bundler-audit (0.6.0) + bundler (~> 1.2) + thor (~> 0.18) byebug (9.0.6) coffee-rails (4.2.1) coffee-script (>= 2.2.0) @@ -90,12 +93,12 @@ GEM mime-types (3.1) mime-types-data (~> 3.2015) mime-types-data (3.2016.0521) - mini_portile2 (2.1.0) + mini_portile2 (2.2.0) minitest (5.10.1) multi_json (1.12.1) nio4r (2.0.0) - nokogiri (1.7.1) - mini_portile2 (~> 2.1.0) + nokogiri (1.8.0) + mini_portile2 (~> 2.2.0) orm_adapter (0.5.0) puma (3.8.2) rack (2.0.1) @@ -196,6 +199,7 @@ PLATFORMS DEPENDENCIES bootstrap-sass brakeman + bundler-audit byebug coffee-rails (~> 4.2) devise