rodlevy

Web Security

This post outlines three common web security vulnerabilities with specific examples in Rails. For a more complete list, I highly recommend the OWASP Rails security cheatsheet.

Cross-Site Scripting (XSS)

A cross-site scripting attack is when malicious scripts are injected into a web site in order to compromise it.

For example, let's say we want to allow html tags such as <strong> in our blog comments, so we render raw output using the Rails method #html_safe:

Instructions:

Download this application skeleton.
Convert the app to use AJAX.
Add any files you changed to your gist and submit your code.

	.container {
	/*
	If you have a block-level element of a certain width, margin: 0 auto;
	will how you center it inside its parent container.

	See: http://bluerobot.com/web/css/center1.html

	Don't change the container width.
	*/
	margin: 0 auto;

	/* Here is your chance to take over Socrates!


	Spend 10 minutes on each of the following hacks to the socrates website.
	Enter them in the console to make sure it works and then save
	your results here.

	Choose a new pair for each. Add your names to the section you complete.
	*/

	/* Here is your chance to take over Socrates!


	Spend 10 minutes on each of the following hacks to the socrates website.
	Enter them in the console to make sure it works and then save
	your results here.

	Choose a new pair for each. Add your names to the section you complete.
	*/
	$('.site-content').css('background-color', 'red');

	//------------------------------------------------------------------------------------------------------------------
	// YOUR CODE: Create your Zoo "object literal" and Animal "constructor" and "prototypes" here.
	//------------------------------------------------------------------------------------------------------------------



	//------------------------------------------------------------------------------------------------------------------
	// DRIVER CODE: Do NOT change anything below this point. Your task is to implement code above to make this work.
	//------------------------------------------------------------------------------------------------------------------

	def testNotSecret
	end