问题
Customer.find(:all, :select => 'id', :order => 'updated_at DESC', :readonly => true, :conditions => { :status_id => Customer.id_for_status(params[:id].to_sym) }, :offset => offset, :limit => 30).collect(&:id)
Above is my query in that I am getting warning like
Symbol conversion from unsafe string (parameter value) near line 33: params[:id].to_sym
This is the warning of Denial of Service. Anybody have any idea how can I fix this warning?
Thanks In Advance
回答1:
The problem here is params[:id].to_sym
When the string which would be converted to symbol is an open set, you should NOT convert them into symbols. Each symbol created will not be garbage collected, and could create potential memory leak which makes your system vulnerable to Dos attacks.
Problem was resolved in Ruby 2.2. but still - rather white list anything that would be converted into symbols.
来源：https://stackoverflow.com/questions/24066556/getting-warning-denial-of-service