Rails Security

Step 0 — Detect

rg -n "^\s*gem ['\"]rails" -g 'Gemfile'
ls app/controllers config 2>/dev/null

Record Rails version (Gemfile.lock), auth stack (Devise/etc.), deployment hints.

Step 1 — SQL injection

rg -n "where\([\"'].*#\{|order\(params|find_by_sql|group\(params|pluck\(params|select\(params" app/

• where("name = '#{params[:name]}'") → Critical
• order(params[:sort]) / pluck(params[:col]) — column names can't be bound → High (allowlist required)
• Safe counterparts: where(name: params[:name]), where("name = ?", ...) → note as positives

Step 2 — Mass assignment

rg -n "permit!|params\[:user\]$|\.update_attributes" app/

• params.permit! (or raw params hash) into new/update on models with role columns (admin, role, credits) → Critical
• Narrow permit(:name, :email) → safe; check listed columns for role leakage

Step 3 — XSS

rg -n "<%=\s*raw\b|\.html_safe|<%==" app/ app/views/

• raw/.html_safe/<%== on user-derived values → direction-triaged (ERB <%= %> escapes by default)

Census, don't sample: disposition every hit. Severity by privilege direction per ../injection-flaws/SKILL.md (XSS table) — raw @user.bio where the bio is student-authored and the view is staff-facing = Critical.

Step 4 — CSRF & authz

rg -n "protect_from_forgery" app/controllers/application_controller.rb
rg -n "skip_before_action :verify_authenticity|skip_forgery_protection" app/
rg -n "before_action :authenticate|before_action :authorize" app/controllers/ | head

• No protect_from_forgery in ApplicationController (and Rails new-app default absent in API mode with cookie sessions) → High
• skip_before_action :verify_authenticity_token on non-webhook controllers → High
• Controllers with mutations but no authenticate_*! before_action → High
• Devise current_user absent + Model.find(params[:id]) in show/edit → IDOR, High

Step 5 — Files, redirects, dispatch

rg -n "send_file|File\.read|IO\.foreach|File\.open" app/
rg -n "redirect_to\s+(params|request\.referer)" app/
rg -n "\bsend\(|public_send\(" app/ | rg "params" | head

• send_file(params[:path]) → traversal, High
• render file: params[:path] → arbitrary file read (CVE-2019-5418 pattern — Action View reads and returns the file); fixed rails versions still make this a design bug → High
• render file: with a first-party literal (Rails.root.join(...)) is fine
• redirect_to(params[:return_to]) → open redirect (phishing/SSRF in OAuth flows), Medium/High
• send(params[:method]) → arbitrary method dispatch, High

Step 6 — Deserialization & config

rg -n "Marshal\.load|Oj\.load|YAML\.load\(" app/ config/
rg -n "secret_key_base" config/ -g '!*.lock' | head
rg -n "force_ssl" config/environments/

• Marshal.load / Oj.load(mode: :object) / YAML.load (non-safe) on external data → Critical
• secret_key_base committed in secrets.yml/initializers → Critical (session forgery)
• config.force_ssl = false in production.rb → Medium

Reporting

Severity table above; fixes are idiomatic one-liners (where(hash:), permit lists, redirect_to allowlist). Note strong-params/ORM positives. Dependency CVEs via ../dependency-vulns/SKILL.md.