It’s been a while!
Changes since 6.0.1:
- Add check for unfiltered search with Ransack
--timingto add timing duration for scan steps
PG::Connection.escape_stringas a SQL sanitization method (Joévin Soulenq)
class << self
- Fix class method lookup in parent classes
- Fix keyword splats in filter arguments
Ransack is a popular library for enabling search against ActiveRecord attributes.
It was originally intended for administrative interfaces (like those provided by ActiveAdmin).
Use usually looks like
And a url might look like
This might generate a query like
SELECT make FROM cars WHERE make LIKE 'vol%';
The library does clever things with the query parameter key.
In this case,
make is the column and
start means match values that start with the search term
However, it’s also possible to specify columns on related tables, such as
Which would search the
name column on the
owners table (assuming
Car has an association to
Prior to Ransack 4.0, the default configuration allowed searching all columns on a table as well as all columns on associated tables.
Some folks figured out this can be used to extract secret values by brute-forcing the value one character at a time.
To fix this issue, explicitly allow list the attributes and associations available to search.
In Ransack 4.0 and later, it is required to set up an allowlist.
Brakeman will warn about unrestricted use of
- High if no allow-listing methods are found in the class hierarchy of the model on which
- Medium if the use happens to be in a file with
adminin the path
- Low if the call to
ransackis not on a class
--timing to output duration of various steps during the scan.
Useful for debugging slowness.
Another SQL Escaping Method
Brakeman will not warn about use of
escape_string in SQL queries.
Brakeman will now treat methods defined inside of
class << self as class methods.
This does mean fingerprints of warnings found inside those methods will change.
Class Method Lookups
Searching for class method definitions in parent classes will now actually look for class methods, not instance methods.
Keyword Splats in Filters
Will no longer cause an error.
The SHA256 sums for this release are:
Thank you to everyone who reported bugs and contributed to this release!
Hang out on Github for questions and discussion.