0

I recently added the Brakeman gem to my Gemfile and had to see, that I should use

:only_path => true

to make it more secure. But i'm using a nested resource and don't know exactly how, here is the part from my Controller.

if @comment.update_attributes(params[:comment])
  redirect_to [@message, @comment], notice: 'Comment was successfully updated.'   

How can i do this, i only saw the only_path attribute with the url_for helper. Thanks for your Help!

4
  • this generates a low confidence warning, right?
    – oreoshake
    Sep 7, 2012 at 17:24
  • Feel free to join the conversation github.com/presidentbeef/brakeman/issues/… :)
    – oreoshake
    Sep 7, 2012 at 20:43
  • @oreoshake: yes, low confidence. I wanted to fix them anyways, to get a bit more sense for security issues. Sep 7, 2012 at 21:24
  • 1
    Well that issue should be fixed really quickly (possibly by the weekend) and your code is indeed secure! Kudos to you for handling the low confidence warnings as well (tons of false positives).
    – oreoshake
    Sep 7, 2012 at 22:43

1 Answer 1

2

The short answer is that brakeman will complain in this case no matter what. A fix is in the mix(https://github.com/presidentbeef/brakeman/issues/143).

As is, your code is safe. The first argument is passed to url_for, which in this case build a polymorphic route based on your models.

Note that by default :only_path is true so you’ll get the relative “/controller/action” instead of the fully qualified URL like “example.com/controller/action”

But to answer your question, it will warn on any form where the first argument resolves to a string, albeit a weak confidence warning. This will be fixed.

TANGENT alert. Let's say you want to redirect_to @message.some_url. This will generate a high confidence warning, which you can fix with something like:

redirect_to URI.parse(url_for(@message.some_url)).path, notice: 'Comment was successfully updated'

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.