ActiveRecord SQL injection and secret_token.rb

Martin Povolny mpovolny at redhat.com
Mon Jan 14 08:36:59 UTC 2013


On Tue, Jan 08, 2013 at 02:49:03PM -0500, Michael Orazi wrote:
> 
> 
> ----- Original Message -----
> > On Fri, Jan 04, 2013 at 09:04:52AM +0100, Vít Ondruch wrote:
> > ...
> > > However, what is more important is, that since your application
> > > secret token
> > > is not that secret, i.e. it is published on github [2], cookies of
> > > Aeolus
> > > could be faked [3]. Katello seems to do better in this area [4]
> > > (although it
> > > was just quick look into code, not security audit :)). Please
> > > consider
> > > narrowing this situation.
> > > 
> > ...
> > > [2]
> > > https://github.com/aeolusproject/conductor/blob/master/src/config/initializers/secret_token.rb#L23
> > > [3]
> > > http://biggestfool.tumblr.com/post/24049554541/reminder-secret-token-rb-is-named-so-for-a-reason
> > > [4]
> > > https://github.com/Katello/katello/blob/master/src/config/initializers/secret_token.rb
> > 
> > I suggest that Conductor should deal with the token the exactly same
> > way Katello
> > does. See no problem in their approach.
> > 
> > Objections?
> > 
> > --
> > Martin Povolny <mpovolny at redhat.com>
> > tel. +420777714458
> > 
> 
> +1 -- if you take this on, please include a patch to 'do the right thing' in configure.
> 

Will fix the copyright year, merge the patch and then fix the configure
right now.

Just came back from holiday to find out someone tried to burgle our
house and that my work mailbox is full of unread messages. Don't know
which is worse ;-)

-- 
Martin Povolny <mpovolny at redhat.com>
tel. +420777714458


More information about the aeolus-devel mailing list