Web applications are attacked constantly. This lesson covers the most common attacks like XSS, CSRF and SQL injection, how Rails protects you, and where you still need to be careful.
Important
Work on this lesson in
advisormode.
Learning goals
- You can explain the CIA triad — confidentiality, integrity, availability — and sort any threat into it.
- You can explain how the most common attacks on web applications work: cross-site scripting, cross-site request forgery, SQL injection, mass assignment, insecure direct object references (e.g. building a file path from user input), session hijacking.
- You know which of these Rails prevents by default and where you still have to do the right thing yourself, e.g. with
html_safe, strong parameters or file paths from parameters. - You can set a strict Content Security Policy for an app and explain what it prevents.
- You can explain how vulnerable dependencies endanger an app and how we find and fix them, e.g. with bundler-audit, CVE advisories and Rails LTS.
- You can explain what HTTPS guarantees against an attacker on the network — and what it doesn't.
- You read code — your own, a colleague's or an agent's — through the eyes of an attacker and spot these vulnerabilities in a review.
- You can use a static analyzer like Brakeman as a safety net and interpret its warnings.
Resources
Read what's new to you, skim what's familiar, skip what you already master. Stop when you can meet the learning goals.
Your agent can also generate an overview, a tutorial or an explanation for anything here, tailored to what you already know. Just ask.
The map
- 📄 The CIA triad Show archive.org snapshot — confidentiality, integrity, availability in one page
- 📄 OWASP Top 10 Show archive.org snapshot — the most common classes of web application vulnerabilities, with examples and countermeasures
Rails
- 📄 Rails Security Guide Show archive.org snapshot — the spine of this card. Read Sessions Show archive.org snapshot , CSRF Show archive.org snapshot , Redirection and files Show archive.org snapshot , Injection Show archive.org snapshot (SQL injection, XSS, and friends) and the Content Security Policy header Show archive.org snapshot . For each: understand the attack, and what Rails gives you against it
- 📄 Strong parameters Show archive.org snapshot — the Rails answer to mass assignment
- 📄 How to use
html_safecorrectly — our card: where Rails' XSS protection ends - 📄 Preventing users from uploading malicious content — our card
- 📄 Sensitive secrets should not live inside our repos — our card (internal)
Content Security Policy
- 📄 Content Security Policy Show archive.org snapshot — MDN guide: what a CSP is and what it prevents
- 📄 A restrictive, still practicable CSP for Rails projects — our card: the policy we start new projects with
- 📄 A compatible default CSP for Rails projects — our card
Vulnerable dependencies
- 📄
bundler-audit
Show archive.org snapshot
— checks your
Gemfile.lockagainst known CVEs - 📄 Brakeman Show archive.org snapshot — static analysis of a Rails app for security warnings
- 📄 How to apply security updates which affect all our Rails applications — our process when a CVE hits (internal)
- 📄 Rails LTS — our product; read why people pay for security patches of old Rails versions
HTTPS
- 📄 How HTTPS works Show archive.org snapshot — an illustrated explanation of certificates, handshakes and what an attacker on the network can and cannot see
Exercises
Controller review
Assume our application has some PDF files with documentation:
app/
config/
db/
documents/
markdown.pdf
search.pdf
registration.pdf
lib/
...
We want to link to a document like this:
= link_to 'Markdown help', '/help?doc=markdown'
So we add a controller that delivers the PDF:
get '/help', to: 'help#download'
class HelpController < ApplicationController
def download
pdf_path = Rails.root + "/documents/" + params[:doc] + ".pdf"
send_file pdf_path
end
end
Is it a good idea to build the controller that way? Can you improve it?
Tip
Get into a habit of reading code through the eyes of an attacker with bad intentions.
XSS in Rails
- Intentionally make MovieDB vulnerable to HTML code injection
- Boot up a second Rails application on another port (e.g.
rails server -p 4000to boot it onhttp://localhost:4000). Assume this is a second domain under the attacker's control. - Exploit your vulnerability by sending MovieDB's cookies to the attacker's Rails app.
Brakeman analysis
Brakeman Show archive.org snapshot is a static analysis tool which checks Ruby on Rails applications for security vulnerabilities.
Read our corresponding guide, then run brakeman -I on your MovieDB.
- If it doesn't find any issues, run it on one of the sample apps you checked out earlier.
- In any case, add a new spec to your MovieDB. It should check that brakeman does not find any (non-ignored) issues.
Understand a few of the warnings and their specific impact on the application you scanned. Could an attacker leverage the issue if we don't address it?
bundler-audit
bundler-audit
Show archive.org snapshot
checks for vulnerable gem versions in your Gemfile.lock.
Run bundler-audit on your MovieDB. If it doesn't find any issues, run it on one of the sample apps you checked out earlier.
Understand a few of the warnings and their specific impact on the application you scanned. Could an attacker leverage the issue if we don't address it?
An attacker on your network
Assume an attacker takes over the router box on your local network. The attacker can see and change any network communication between your PC and the internet.
Unaware of the attacker, you purchase articles in an online shop. Answer the following questions for both cases (1) with HTTP and (2) with HTTPS:
- Can the attacker see that you're accessing the shop?
- Can the attacker see how often you're accessing the shop?
- Can the attacker see what articles you're browsing?
- Can the attacker copy your session cookies?
- Can the attacker record the network traffic while you're making a request, then send the same bytes from their own machine and get the same response ("replay attack")?
- Can the attacker set up a fake web app on your local network and respond to your requests to the shop?
- Is it safe to give your credit card information to a shop with a valid SSL certificate?
