Passing query parameters to render() and template_exists?

[paranoicsan]

Background

Brakeman version: 4.0.1
Rails version: 4.2.4
Ruby version: 2.3.3

Issue

Passing query parameters to render() is vulnerable in Rails 4.2.4 (CVE-2016-0752)

Relevant code:

def show_slug
  slug = params[:slug].to_s
  render slug if template_exists?(slug, 'pages')
end

Is there any possibility to handle Passing query parameters... with template_exists? method? Or should I mark show_slug method as safe?

[presidentbeef]

Hi Alexander,

I suppose this could be fixed, but... Rails 4.2.4 has a bunch of known vulnerabilities. Maybe it would be a good idea to upgrade?

[paranoicsan]

Hi Justin,

Thanks for respond to my issue. I've got Rails upgrade on my plan 😄
So I think I'll solve the problem using upgrade if it's difficult to fix it on the project side.

[paranoicsan]

After upgrading Rails to 4.2.7.1 warning message changed to Render path contains parameter value but it's still there 😞 So the only way I think is to add it to ignore list.

[paranoicsan]

@presidentbeef Justin, thanks for dealing with that! 👍