Ruby method and class injection
A class name in user input: Anything can happen.
Excel Injection via Rails downloads
A = in a name could make Excel run macros.
Rails SQL Injection with LIKE
Injection with % in SQL LIKE is common and may lead to long queries.
CSS Injection in Rails
Can CSS from the user do any harm?
A Content Security Policy (CSP) strategy
CSP is a great way to reduce or completely remove the number 1 web app security vulnerability – Cross-Site Scripting (XSS).
Cross-Site Request Forgery and Rails
CSRF explained and all related questions answered
Secure configuration of Rails applications
Store secrets in the environment variables, secure and manage them
Command injection in Rails
Injecting parameters or entire Unix commands
HTML-safe, ActiveSupport::SafeBuffer explained
How does Rails’ XSS protection work exactly
XSS protection in Haml templates
Haml templates support Rails’ XSS protection
