Hacker News Reader

This bug is pretty edge, but if there was an easy way for a user to put a symbol in the params hash the bug would be a pretty gnarly universal SQL injection vulnerability for all versions of Rails.

Though if that was easy it would most likely have been caught much, much earlier as there are a multitude of find helpers that allow literal SQL to be injected.

View on HN

Early versions of Rails explicitly made the decision to never symbolize user inputted hashes because symbols are never garbage collected. This would allow memory to grow unbounded. As a result Rails stores all user hash keys as strings.

Thank you... I always wondered why that was true.

So it's just serendipitous that this isn't the obvious and massive vulnerability it initially seemed to be.

Ah, I also wondered about that. Is that why HashWithIndifferentAccess uses strings internally?

There are suggestions that it is possible (potentially easy) for a user to get symbols into the params hash.

Reply on news.ycombinator.com