securails 0.0.1

data/.gitignore

@@ -0,0 +1,5 @@
+*.gem
+.bundle
+.idea
+Gemfile.lock
+pkg/*

data/Gemfile

@@ -0,0 +1,4 @@
+source "http://rubygems.org"
+
+# Specify your gem's dependencies in securails.gemspec
+gemspec

data/README.md

@@ -0,0 +1,37 @@
+# Securails
+
+By default, all ActiveRecord attributes are writable. This leads to security problems:
+
+* http://asciicasts.com/episodes/26-hackers-love-mass-assignment
+* http://lesseverything.com/blog/archives/2008/03/11/use-attr_protected-or-we-will-hack-you/
+* https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57
+
+This gem makes all attributes protected by default. To use individual attributes for mass assignment,
+please make them explicitely assignable using `attr_accessible`. More info [here](http://api.rubyonrails.org/classes/ActiveModel/MassAssignmentSecurity/ClassMethods.html#method-i-attr_accessible).
+
+
+# Installation
+
+1.  Add the gem to your Gemfile.
+
+    ```ruby
+    gem 'securails'
+    ```
+
+2.  Update your gem bundle.
+
+    ```bash
+    $ bundle install
+    ```
+
+# Usage
+
+Your app is safe by just including the gem. Now you have make those attributes that are safe to be changed by users accessible.
+
+```ruby
+class Company < ActiveRecord::Base
+
+  # Allow access to the 'name' attribute.
+  attr_accessible :name
+end
+```

data/Rakefile

@@ -0,0 +1 @@
+require "bundler/gem_tasks"

data/lib/securails.rb

@@ -0,0 +1,2 @@
+require 'securails/railtie'
+require 'securails/version'

data/lib/securails/railtie.rb

@@ -0,0 +1,13 @@
+require "rails/railtie"
+
+module Securails
+
+  class Railtie < Rails::Railtie
+
+    # Initialize Straides after the Rails initializers have run.
+    config.after_initialize do
+      ActiveRecord::Base.send :attr_accessible, nil
+    end
+  end
+
+end

data/lib/securails/version.rb

@@ -0,0 +1,3 @@
+module Securails
+  VERSION = "0.0.1"
+end

data/securails.gemspec

@@ -0,0 +1,27 @@
+# -*- encoding: utf-8 -*-
+$:.push File.expand_path("../lib", __FILE__)
+require "securails/version"
+
+Gem::Specification.new do |s|
+  s.name        = "securails"
+  s.version     = Securails::VERSION
+  s.authors     = ["Kevin Goslar"]
+  s.email       = ["kevin.goslar@originate.com"]
+  s.homepage    = ""
+  s.summary     = %q{Secures a rails application by making all ActiveRecord model attributes protected by default.}
+  s.description = %q{Rails has a security flaw: All attributes are writable by default. 
+                     This allows for spectacular hacks, like this one: https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57. 
+                     This gem makes all attributes protected by default. }
+
+  s.rubyforge_project = "securails"
+
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+  s.require_paths = ["lib"]
+
+  # specify any dependencies here; for example:
+  s.add_dependency "rails"
+  # s.add_development_dependency "rspec"
+  # s.add_runtime_dependency "rest-client"
+end

metadata

@@ -0,0 +1,67 @@
+--- !ruby/object:Gem::Specification
+name: securails
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+  prerelease: 
+platform: ruby
+authors:
+- Kevin Goslar
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-03-06 00:00:00.000000000Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: &70268580882840 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: *70268580882840
+description: ! "Rails has a security flaw: All attributes are writable by default.
+  \n                     This allows for spectacular hacks, like this one: https://github.com/rails/rails/commit/b83965785db1eec019edf1fc272b1aa393e6dc57.
+  \n                     This gem makes all attributes protected by default. "
+email:
+- kevin.goslar@originate.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- Gemfile
+- README.md
+- Rakefile
+- lib/securails.rb
+- lib/securails/railtie.rb
+- lib/securails/version.rb
+- securails.gemspec
+homepage: ''
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: securails
+rubygems_version: 1.8.10
+signing_key: 
+specification_version: 3
+summary: Secures a rails application by making all ActiveRecord model attributes protected
+  by default.
+test_files: []