RoR application request parameters getting overwritten with random symbol
So I have an application running Ruby 2.7.6 and Rails 6.1. Also using rom and from-https for API calls. We have suddenly started to see our URLs in the browser, as well as server-side API request parameters, get overwritten with one of the symbols we use to represent an ID in the code. I have started Ruby Training, But I can't able to solve this code.
:search_id is a symbol we do use as a request parameter in many other places where we send a unique id related to a user search. But somehow, it has been injecting itself into almost all API calls as the actual value (encoded as %3Asearch_id). Sometimes we see API calls filled with almost every request parameter set this way.
The suspect is that something in active resource or one of the rom gems has changed at some point and we never accounted for it. There are some requests that would have &search_id as a request parameter... but with this bug the symbol :search_id itself is getting into the right side of param values.
Does this sound familiar to anyone?
Does this sound familiar to anyone?
Request handler code that processes data to form the final request:
def call(dataset)
uri = URI(dataset.uri)
uri.path += [dataset.name, dataset.path.presence].compact.join('/') + '.json'
# recaptcha api endpoint urls
Rails.logger.info "api endpoint is #{dataset.name}"
if (dataset.name == '/hotels/rooms' && Settings.enable_recaptcha)
api_path = dataset.name.split('/')
uri = URI(Settings.recaptcha_api_gateway_url)
uri.path += ['/', api_path.last, dataset.path.presence].compact.join('/')
end
if Rails.env == 'test' && dataset.name == '/hotels/rateshopping'
dataset.params[:client_ip] = "74.125.228.110"
end
Microsoft Security | Microsoft Graph
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more