Add .to_sym DOS vuln

[mccabe615]

Add an action that accepts a user param that is converted to a symbol leading to a DOS.

Source:
http://brakemanscanner.org/docs/warning_types/denial_of_service/index.html

[steakunderscore]

As of Ruby 2.2 symbols are now garbage collected. So to my understanding the app would need to revert to pre 2.2 to make this vulnerability possible.

Instead a DOS vulnerability could implemented via using sleep(). If you are using a app server that blocks on sleep, by saturating your app server pool with busy waiting will result in DOS. We could add a sleep(5) to one of the pages?

[mccabe615]

Good call. I think instead of sleep we should do something slightly less obvious that would result in a DoS. Such as a slow SQL query or regex. Would you want to implement something like that?

[mccabe615]

Good call. I think rather than an easy example like a system call to sleep or Ruby sleep, we should implement something a little less obvious. Such as a long SQL query or regex that would lead to DoS.

Would you like to help implement that @steakunderscore?

[steakunderscore]

I was trying to make a slow regex that could be hidden, but it was actually harder than I thought it would be. Making use of the max get request size of just over 8k. This is what I came up with:

~/D/g/railsgoat » cat slow_regex.rb                                                                                                                     ± master:e49dfd5 
require 'benchmark'

Benchmark.bm do |x|
  x.report { /((\w)+(\1)+\2)+y/   =~ 'x' * 8000 + 'y' }
end
~/D/g/railsgoat » ruby slow_regex.rb                                                                                                                    ± master:e49dfd5 
       user     system      total        real
   1.170000   0.000000   1.170000 (  1.171442)

I'll have another look at it, maybe a slow sql statment, soon.

[steakunderscore]

I haven't had time to look further into slow regex/sql. Is it worth closing this issue as the patch with a sleep was merged. Then open a different issue to replace the sleep method call?

[mccabe615]

I think that makes sense. Thanks.

On Thu, Mar 10, 2016 at 3:01 PM, Henry Jenkins notifications@github.com
wrote:

I haven't had time to look further into slow regex/sql. Is it worth
closing this issue as the patch
#221 with a sleep was merged.
Then open a different issue to replace the sleep method call?

—
Reply to this email directly or view it on GitHub
#41 (comment).

[mccabe615]

Implemented by #221