Ruby method and class injection
Berga A class name in user input: Anything can happen.
Excel Injection via Rails downloads
http://www.jeanjacquesmontlahuc.fr/265-dtgf86614-rencontres-gay-limoges.html A = in a name could make Excel run macros.
Rails SQL Injection with LIKE
cenforce Injection with % in SQL LIKE is common and may lead to long queries.
CSS Injection in Rails
matura cerca uomo Can CSS from the user do any harm?
A Content Security Policy (CSP) strategy
CSP is a great way to reduce or completely remove the number 1 web app security vulnerability – Cross-Site Scripting (XSS).
Cross-Site Request Forgery and Rails
CSRF explained and all related questions answered
Secure configuration of Rails applications
Store secrets in the environment variables, secure and manage them
Command injection in Rails
Injecting parameters or entire Unix commands
HTML-safe, ActiveSupport::SafeBuffer explained
How does Rails’ XSS protection work exactly
XSS protection in Haml templates
Haml templates support Rails’ XSS protection
