收到警告:拒绝服务 [英] Getting warning : Denial of Service

问题描述

Customer.find(:all, :select => 'id', :order => 'updated_at DESC', :readonly => true, :conditions => { :status_id => Customer.id_for_status(params[:id].to_sym) }, :offset => offset, :limit => 30).collect(&:id)

以上是我的查询，因为我收到类似

Above is my query in that I am getting warning like

Symbol conversion from unsafe string (parameter value) near line 33: params[:id].to_sym

这是拒绝服务的警告.有人知道如何解决此警告吗?

This is the warning of Denial of Service. Anybody have any idea how can I fix this warning?

预先感谢

推荐答案

这里的问题是 params [:id] .to_sym

当要转换为符号的字符串是开放集时，请勿将其转换为符号.创建的每个符号都不会被垃圾回收，并可能导致潜在的内存泄漏，使您的系统容易受到Dos攻击.

When the string which would be converted to symbol is an open set, you should NOT convert them into symbols. Each symbol created will not be garbage collected, and could create potential memory leak which makes your system vulnerable to Dos attacks.

问题在Ruby 2.2中已解决.但仍然-相当白名单列出了将要转换为符号的所有内容.

Problem was resolved in Ruby 2.2. but still - rather white list anything that would be converted into symbols.

这篇关于收到警告:拒绝服务的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！