ActiveRecord SQL injection and secret_token.rb

Jiří Stránský jistr at redhat.com
Fri Jan 4 12:29:09 UTC 2013


On 4.1.2013 13:20, Jiří Stránský wrote:
> On 4.1.2013 12:56, Martin Povolny wrote:
>> On Fri, Jan 04, 2013 at 09:04:52AM +0100, Vít Ondruch wrote:
>> ...
>>> However, what is more important is, that since your application secret token
>>> is not that secret, i.e. it is published on github [2], cookies of Aeolus
>>> could be faked [3]. Katello seems to do better in this area [4] (although it
>>> was just quick look into code, not security audit :)). Please consider
>>> narrowing this situation.
>>>
>> ...
>>> [2] https://github.com/aeolusproject/conductor/blob/master/src/config/initializers/secret_token.rb#L23
>>> [3] http://biggestfool.tumblr.com/post/24049554541/reminder-secret-token-rb-is-named-so-for-a-reason
>>> [4] https://github.com/Katello/katello/blob/master/src/config/initializers/secret_token.rb
>>
>> I suggest that Conductor should deal with the token the exactly same way Katello
>> does. See no problem in their approach.
>
> +1.
>
> First I totally freaked out, then pblaho showed me that aeolus-configure changes the token every time it is run. It writes directly to the secret_token.rb file. However, this is still a big problem if someone doesn't run aeolus-configure for whatever reason. I think we should adopt the Katello's solution.
>
> J.

... and we shouldn't configure stuff by overwriting source code files anyway ;)


More information about the aeolus-devel mailing list