📝
Security Traps
2329
0次下载
2次浏览
2026/3/9
- `where("email = '#{params[:email]}'")` — SQL injection, use `where(email: params[:email])` - `Model.new(params[:model])` without permit — mass assignment even with strong params - `skip_forgery_protection` on API — still needed if session-based auth - `html_safe` on user input — stored XSS, escape first then mark safe - `send(params[:method])` — arbitrary method call, whitelist allowed methods
广告位 300x250
资源信息
- 数据来源
- bigquery-gharchive
- 分类
- data-analysis
- 创建时间
- 2026/3/9
- 更新时间
- 2026/3/14
评论 (0)
登录后发表评论
加载中...