I am using Ruby on Rails 4.1.1 and I am thinking to accept parameters (through URL query strings) that are passed directly to the url_for
method, this way:
# URL in the browser
http://www.myapp.com?redirect_to[controller]=users&redirect_to[action]=show&redirect_to[id]=1
# Controller
...
redirect_to url_for(params[:redirect_to].merge(:only_path => true))
Adopting the above approach users can be redirected after performing an action. However, I think people can enter arbitraryparams
that can lead to security issues...
Is it safe to accept URL parameters for populating the url_for
method? What are pitfalls? What can happen in the worst case?
By logging params
during requests to my application I noted Rails adds always :controller
and action
parameters. Maybe that confirms url_for
can be used the above way since it is protected internally and works as-like Rails is intended to.
Rails
redirect_to
sets the HTTP status code to302 Found
which tells the browser toGET
the new path as you defined it byurl_for
.GET
is a considered a safe method in contrast toThe only problem would have been if someone could gain access to methods such as
create
anddestroy
. Since these methods use HTTP methods other thanGET
(respectivelyPOST
andDELETE
) it should be no problem.Another danger here is if you go beyond CRUD methods of REST and have a custom method which responses to
GET
and changes the database state:routes.rb
SomethingController
For future ref:
Rails has a number of security measurements which may also interest you.
This it is safe internally as Ruby On Rails will only be issuing a HTTP redirect response.
As you are using
only_path
this will protect you from an Open redirect vulnerability. This is where an email is sent by an attacker containing a link in the following format (say your site isexample.com
).As the user checks the URL and sees it is on the
example.com
domain they beleive it is safe so click the link. However, if there's an open redirect then the user ends up onevil.com
which could ask for theirexample.com
password without the user noticing.Redirecting to a relative path only on your site fixes any vulnerability.
In your case you are giving users control of your controller, action and parameters. As long as your GET methods are safe (i.e. no side-effects), an attacker could not use this by creating a crafted link that the user opens.
In summary, from the information provided I don't see any risk from phishing URLs to your application.
It's not exactly an answer, just wanted to point out that you shouldn't use something like
because one could pass
host
andport
as params and thus the url could lead to another site and it can get worse if it gets cached or something.Don't know if it threatens anything, but hey, it's worth pointing out