Rails security defaults: CSRF, XSS and SQLi

# What the authenticity token does in a Rails 8.1 app running in production mode. One form posts a notice and one
# posts a sign-in; the browser is an integration session, the tool Rails' own integration tests use, so it keeps the
# session cookie between requests. Each POST is sent without a token, with the token the form carried, with the
# token from the csrf-token meta tag (what Turbo sends), and with a made-up token. Token values change on every
# run, so only their lengths are printed.
ENV["RAILS_ENV"] = "production"
require "rails"
require "action_controller/railtie"
require "action_view/railtie"
require "action_dispatch/testing/integration"
require "nokogiri"

module Kaksha
  class Application < Rails::Application
    config.load_defaults 8.1
    config.eager_load = false
    config.logger = Logger.new(nil)
    config.secret_key_base = "kaksha-one-file-example-" * 3 # production keeps this in its credentials
  end
end
Kaksha::Application.initialize!

class ApplicationController < ActionController::Base
  prepend_view_path File.join(__dir__, "csrf_views")
end

class NoticesController < ApplicationController
  def new; end

  def create
    redirect_to "/notices", notice: "Notice published"
  end
end

class SessionsController < ApplicationController
  def new; end

  def create
    redirect_to "/", notice: "Signed in"
  end
end

Kaksha::Application.routes.draw do
  resources :notices, only: %i[new create]
  resource :session, only: %i[new create]
end

puts "Rails.env: #{Rails.env}"
puts "allow_forgery_protection: #{ActionController::Base.allow_forgery_protection}"

browser = ActionDispatch::Integration::Session.new(Kaksha::Application)
browser.host! "kaksha.example"

# Fetches a form page and returns the token its hidden field carries and the one in its csrf-token meta tag.
read_tokens = lambda do |path|
  browser.get path
  page = Nokogiri::HTML5(browser.response.body)
  form = page.at_css("form")
  field = form.at_css("input[name=authenticity_token]")
  meta = page.at_css("meta[name=csrf-token]")
  puts "GET #{path} -> #{browser.response.status}"
  puts "  form: #{form['method']} #{form['action']}, hidden field #{field['name']} of #{field['value'].length} characters"
  puts "  head: meta csrf-param=#{page.at_css('meta[name=csrf-param]')['content']}, csrf-token of #{meta['content'].length} characters"
  cookie = Array(browser.response.headers["set-cookie"]).join("\n").lines.first.to_s
  puts "  session cookie: #{cookie.split('; ').drop(1).join('; ').strip}" unless cookie.empty?
  [field["value"], meta["content"]]
end

send_post = lambda do |label, path, params: {}, headers: {}|
  browser.post path, params: params, headers: headers
  response = browser.response
  where = response.redirect? ? " to #{response.location.delete_prefix('http://kaksha.example')}" : ""
  puts "POST #{path}, #{label} -> #{response.status}#{where}"
end

form_token, meta_token = read_tokens.("/notices/new")
send_post.("no token", "/notices", params: { title: "Fee reminder" })
send_post.("the token from the form", "/notices", params: { title: "Fee reminder", authenticity_token: form_token })
send_post.("the meta token in X-CSRF-Token", "/notices", params: { title: "Fee reminder" }, headers: { "X-CSRF-Token" => meta_token })
send_post.("a made-up token", "/notices", params: { title: "Fee reminder", authenticity_token: "not-the-token" })

login_token, = read_tokens.("/session/new")
send_post.("no token", "/session", params: { email_address: "asha@example.com", password: "a-long-password" })
send_post.("the token from the form", "/session", params: { email_address: "asha@example.com", password: "a-long-password", authenticity_token: login_token })

Rails.env: production
allow_forgery_protection: true
GET /notices/new -> 200
  form: post /notices, hidden field authenticity_token of 86 characters
  head: meta csrf-param=authenticity_token, csrf-token of 86 characters
  session cookie: path=/; httponly; samesite=lax
POST /notices, no token -> 422
POST /notices, the token from the form -> 302 to /notices
POST /notices, the meta token in X-CSRF-Token -> 302 to /notices
POST /notices, a made-up token -> 422
GET /session/new -> 200
  form: post /session, hidden field authenticity_token of 86 characters
  head: meta csrf-param=authenticity_token, csrf-token of 86 characters
  session cookie: path=/; httponly; samesite=lax
POST /session, no token -> 422
POST /session, the token from the form -> 302 to /

require "test_helper"

class CsrfTest < ActionDispatch::IntegrationTest
  # The generated test environment switches forgery protection off, so a test about it has to switch it on.
  setup do
    @before = ActionController::Base.allow_forgery_protection
    ActionController::Base.allow_forgery_protection = true
  end

  teardown do
    ActionController::Base.allow_forgery_protection = @before
  end

  test "a post without a token is refused" do
    assert_no_difference "Notice.count" do
      post notices_path, params: { notice: { title: "Fee reminder", body: "Due Friday" } }
    end
    assert_response :unprocessable_content
  end

  test "a post with the token from the form is accepted" do
    get new_notice_path
    token = css_select("form input[name=authenticity_token]").first["value"]
    assert_difference "Notice.count", 1 do
      post notices_path, params: { notice: { title: "Fee reminder", body: "Due Friday" }, authenticity_token: token }
    end
    assert_response :redirect
  end
end

# The same refusal tested twice against the fixed controller, which keeps forgery protection on. The first test
# leaves the test environment as Rails generated it and fails; the second switches the protection on for its own
# tests and passes.
require_relative "session"

Session.run(<<~SH, fails: ["bin/rails test test/integration/csrf_default_test.rb --seed 1"])
  cd ../kaksha
  cp -R ../lab/. .
  cp -R ../lab-fixed/. .
  cp ../lab-trap/test/integration/csrf_default_test.rb test/integration/csrf_default_test.rb
  grep -n forgery config/environments/test.rb
  bin/rails test test/integration/csrf_default_test.rb --seed 1
  bin/rails test test/integration/csrf_test.rb --seed 1
SH

$ cd ../kaksha
$ cp -R ../lab/. .
$ cp -R ../lab-fixed/. .
$ cp ../lab-trap/test/integration/csrf_default_test.rb test/integration/csrf_default_test.rb
$ grep -n forgery config/environments/test.rb
28:  # Disable request forgery protection in test environment.
29:  config.action_controller.allow_forgery_protection = false
$ bin/rails test test/integration/csrf_default_test.rb --seed …
Running 1 tests in a single process (parallelization threshold is 50)
Run options: --seed …

# Running:

F

Failure:
CsrfDefaultTest#test_a_post_without_a_token_is_refused [test/integration/csrf_default_test.rb:7]:
Expected response to be a <422: unprocessable_content>, but was a <302: Found> redirect to <http://www.example.com/notices/756651094>
Response body: 

bin/rails test test/integration/csrf_default_test.rb:5



Finished in …s, … runs/s, … assertions/s.
1 runs, 1 assertions, 1 failures, 0 errors, 0 skips
[exit status 1]
$ bin/rails test test/integration/csrf_test.rb --seed …
Running 2 tests in a single process (parallelization threshold is 50)
Run options: --seed …

# Running:

..

Finished in …s, … runs/s, … assertions/s.
2 runs, 6 assertions, 0 failures, 0 errors, 0 skips

<article>
  <p id="raw"><%= raw notice.body %></p>
  <p id="html-safe"><%= notice.body.html_safe %></p>
  <p id="double-equals"><%== notice.body %></p>
  <p id="link"><%= link_to "Website", notice.website %></p>
  <script id="data">var notice = <%= raw JSON.generate(notice.to_h) %>;</script>
</article>

<article>
  <p id="raw"><%= notice.body %></p>
  <p id="html-safe"><%= notice.body %></p>
  <p id="double-equals"><%= notice.body %></p>
  <p id="link"><%= safe_link_to "Website", notice.website %></p>
  <div id="data" data-notice="<%= JSON.generate(notice.to_h) %>"></div>
</article>

# The same notice rendered by a template that switches escaping off and by its fixed twin. The notice holds a plain
# marker, <b>tag</b>, and a link that starts with javascript: but only calls a function that does not exist; nothing in
# this file attacks anything. Nokogiri counts what reached the page: bold elements that came from the text and links
# whose address starts with javascript:; a pattern counts the "<" characters left in the notice's data as written in
# the HTML source, inside the script or inside the attribute.
ENV["RAILS_ENV"] = "production"
require "rails"
require "action_controller/railtie"
require "action_view/railtie"
require "nokogiri"

module Kaksha
  class Application < Rails::Application
    config.load_defaults 8.1
    config.eager_load = false
    config.logger = Logger.new(nil)
    config.secret_key_base = "kaksha-one-file-example-" * 3
  end
end
Kaksha::Application.initialize!

# A link helper that only builds a link for http and https addresses and prints the text of any other address.
module SafeLinkHelper
  def safe_link_to(name, address)
    scheme = URI.parse(address.to_s).scheme
    %w[http https].include?(scheme) ? link_to(name, address) : name
  rescue URI::InvalidURIError
    name
  end
end

class ApplicationController < ActionController::Base
  prepend_view_path File.join(__dir__, "xss_views")
  helper SafeLinkHelper
end

Notice = Struct.new(:title, :body, :website, keyword_init: true)
notice = Notice.new(title: "Fee reminder", body: "<b>tag</b>", website: "javascript:marker()")

%w[weak fixed].each do |name|
  html = ApplicationController.render(partial: "#{name}/notice", locals: { notice: notice })
  page = Nokogiri::HTML5.fragment(html)
  puts "#{name}/_notice.html.erb"
  html.each_line { |line| puts "  #{line.rstrip}" unless line.strip.empty? }
  bold = page.css("p b").size
  js_links = page.css("a").count { |a| a["href"].to_s.start_with?("javascript:") }
  data = html[/var notice = (.*?);<\/script>/m, 1] || html[/data-notice="(.*?)"/m, 1]
  angle = data.count("<")
  puts "  check: bold elements from text #{bold}, links to javascript: #{js_links}, angle brackets in the data source #{angle}"
end

weak/_notice.html.erb
  <article>
    <p id="raw"><b>tag</b></p>
    <p id="html-safe"><b>tag</b></p>
    <p id="double-equals"><b>tag</b></p>
    <p id="link"><a href="javascript:marker()">Website</a></p>
    <script id="data">var notice = {"title":"Fee reminder","body":"<b>tag</b>","website":"javascript:marker()"};</script>
  </article>
  check: bold elements from text 3, links to javascript: 1, angle brackets in the data source 2
fixed/_notice.html.erb
  <article>
    <p id="raw">&lt;b&gt;tag&lt;/b&gt;</p>
    <p id="html-safe">&lt;b&gt;tag&lt;/b&gt;</p>
    <p id="double-equals">&lt;b&gt;tag&lt;/b&gt;</p>
    <p id="link">Website</p>
    <div id="data" data-notice="{&quot;title&quot;:&quot;Fee reminder&quot;,&quot;body&quot;:&quot;&lt;b&gt;tag&lt;/b&gt;&quot;,&quot;website&quot;:&quot;javascript:marker()&quot;}"></div>
  </article>
  check: bold elements from text 0, links to javascript: 0, angle brackets in the data source 0

# The SQL that each way of writing a query produces for the same input, a surname with an apostrophe in it. to_sql
# shows the statement Active Record would send without sending it; the last block runs the statements on an
# in-memory database. The unsafe forms are here to be recognised: the second one breaks on an ordinary surname.
require "active_record"
require "logger"

ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
ActiveRecord::Schema.verbose = false
ActiveRecord::Schema.define do
  create_table :notices do |t|
    t.string :title, null: false
    t.timestamps
  end
end

class Notice < ActiveRecord::Base
  SORTS = { "newest" => { id: :desc }, "title" => { title: :asc } }.freeze

  def self.sorted(key)
    order(SORTS.fetch(key, SORTS["newest"]))
  end
end

["Brown", "O'Brien"].each { |title| Notice.create!(title: title) }

q = "O'Brien" # what a parent typed in the search box

forms = {
  "hash condition          " => Notice.where(title: q),
  "placeholder             " => Notice.where("title LIKE ?", "%#{q}%"),
  "named placeholder       " => Notice.where("title LIKE :q", q: "%#{q}%"),
  "string interpolation    " => Notice.where("title LIKE '%#{q}%'"),
}
puts "search for #{q}:"
forms.each { |name, relation| puts "  #{name} #{relation.to_sql}" }

puts "\nwhat happens when each form runs:"
forms.each do |name, relation|
  result = relation.pluck(:title).inspect
  puts "  #{name} #{result}"
rescue ActiveRecord::StatementInvalid => error
  puts "  #{name} #{error.class}: #{error.message.lines.first.strip.delete_suffix(":")}"
end

# Runs the block and prints what came back, or the class of the error it raised (with the database's own message
# when the database refused the statement).
show = lambda do |label, &block|
  puts "  #{label.ljust(30)} #{block.call.inspect}"
rescue ActiveRecord::UnknownAttributeReference => error
  puts "  #{label.ljust(30)} #{error.class}"
rescue ActiveRecord::StatementInvalid => error
  puts "  #{label.ljust(30)} #{error.class}: #{error.message.lines.first.strip.delete_suffix(":")}"
end

puts "\nvalues passed straight to order, pluck and find_by_sql:"
["title", "length(title)", "1 + 1", "banana"].each do |value|
  show.("order(#{value.inspect})") { Notice.order(value).pluck(:title) }
end
show.("pluck(\"1 + 1\")") { Notice.pluck("1 + 1") }
show.("order(Arel.sql(\"1 + 1\"))") { Notice.order(Arel.sql("1 + 1")).pluck(:title) }
show.("find_by_sql with #{q}") { Notice.find_by_sql("SELECT * FROM notices WHERE title = '#{q}'").map(&:title) }

puts "\nthe same keys through an allowlist:"
%w[title newest banana].each { |key| puts "  sort=#{key.ljust(6)} #{Notice.sorted(key).to_sql}" }

search for O'Brien:
  hash condition           SELECT "notices".* FROM "notices" WHERE "notices"."title" = 'O''Brien'
  placeholder              SELECT "notices".* FROM "notices" WHERE (title LIKE '%O''Brien%')
  named placeholder        SELECT "notices".* FROM "notices" WHERE (title LIKE '%O''Brien%')
  string interpolation     SELECT "notices".* FROM "notices" WHERE (title LIKE '%O'Brien%')

what happens when each form runs:
  hash condition           ["O'Brien"]
  placeholder              ["O'Brien"]
  named placeholder        ["O'Brien"]
  string interpolation     ActiveRecord::StatementInvalid: SQLite3::SQLException: near "Brien": syntax error

values passed straight to order, pluck and find_by_sql:
  order("title")                 ["Brown", "O'Brien"]
  order("length(title)")         ["Brown", "O'Brien"]
  order("1 + 1")                 ActiveRecord::UnknownAttributeReference
  order("banana")                ActiveRecord::StatementInvalid: SQLite3::SQLException: no such column: banana
  pluck("1 + 1")                 ActiveRecord::UnknownAttributeReference
  order(Arel.sql("1 + 1"))       ["Brown", "O'Brien"]
  find_by_sql with O'Brien       ActiveRecord::StatementInvalid: SQLite3::SQLException: near "Brien": syntax error

the same keys through an allowlist:
  sort=title  SELECT "notices".* FROM "notices" ORDER BY "notices"."title" ASC
  sort=newest SELECT "notices".* FROM "notices" ORDER BY "notices"."id" DESC
  sort=banana SELECT "notices".* FROM "notices" ORDER BY "notices"."id" DESC

# Deliberately weak and for the lab only: never deploy this file.
class StudentsController < ApplicationController
  def update
    student = Student.find(params[:id])
    student.update!(student_params)
    redirect_to notices_path
  end

  private
    def student_params
      params.expect(student: [ :name, :bio, :role, :centre_id ])
    end
end

# One controller, three checks about mass assignment: the name may change, the role and the centre may not. The first
# run is against the controller that permits :role and :centre_id, and it fails; then the fixed controller replaces
# it and the same checks run again.
require_relative "session"

Session.run(<<~SH, fails: ["bin/rails test test/integration/mass_assignment_test.rb --seed 1"])
  cd ../kaksha
  cp -R ../lab/. .
  grep -n "params.expect" app/controllers/students_controller.rb
  bin/rails test test/integration/mass_assignment_test.rb --seed 1
  cp ../lab-fixed/app/controllers/students_controller.rb app/controllers/students_controller.rb
  grep -n "params.expect" app/controllers/students_controller.rb
  bin/rails test test/integration/mass_assignment_test.rb --seed 2
SH

$ cd ../kaksha
$ cp -R ../lab/. .
$ grep -n "params.expect" app/controllers/students_controller.rb
11:      params.expect(student: [ :name, :bio, :role, :centre_id ])
$ bin/rails test test/integration/mass_assignment_test.rb --seed …
Running 3 tests in a single process (parallelization threshold is 50)
Run options: --seed …

# Running:

.F

Failure:
MassAssignmentTest#test_a_student_cannot_move_themselves_to_another_centre [test/integration/mass_assignment_test.rb:19]:
the centre was set from a request parameter.
Expected: 7
  Actual: 99

bin/rails test test/integration/mass_assignment_test.rb:16

F

Failure:
MassAssignmentTest#test_a_student_cannot_make_themselves_an_admin [test/integration/mass_assignment_test.rb:13]:
the role was set from a request parameter.
Expected: "student"
  Actual: "admin"

bin/rails test test/integration/mass_assignment_test.rb:10



Finished in …s, … runs/s, … assertions/s.
3 runs, 3 assertions, 2 failures, 0 errors, 0 skips
[exit status 1]
$ cp ../lab-fixed/app/controllers/students_controller.rb app/controllers/students_controller.rb
$ grep -n "params.expect" app/controllers/students_controller.rb
10:      params.expect(student: [ :name, :bio ])
$ bin/rails test test/integration/mass_assignment_test.rb --seed …
Running 3 tests in a single process (parallelization threshold is 50)
Run options: --seed …

# Running:

...

Finished in …s, … runs/s, … assertions/s.
3 runs, 3 assertions, 0 failures, 0 errors, 0 skips

# Run using bin/ci

CI.run do
  step "Setup", "bin/setup --skip-server"

  step "Style: Ruby", "bin/rubocop"

  step "Security: Gem audit", "bin/bundler-audit"
  step "Security: Importmap vulnerability audit", "bin/importmap audit"
  step "Security: Brakeman code analysis", "bin/brakeman --quiet --no-pager --exit-on-warn --exit-on-error"
  step "Tests: Rails", "bin/rails test"
  step "Tests: Seeds", "env RAILS_ENV=test bin/rails db:seed:replant"

  # Optional: Run system tests
  # step "Tests: System", "bin/rails test:system"

  # Optional: set a green GitHub commit status to unblock PR merge.
  # Requires the `gh` CLI and `gh extension install basecamp/gh-signoff`.
  # if success?
  #   step "Signoff: All systems go. Ready for merge and deploy.", "gh signoff"
  # else
  #   failure "Signoff: CI failed. Do not merge or deploy.", "Fix the issues and try again."
  # end
end

# The whole lab, weak and then fixed: copy the weak files over Kaksha and run every check (six of the nine fail), then
# copy the fixed files and run the same checks again.
require_relative "session"

Session.run(<<~SH, fails: ["bin/rails test --seed 1"])
  cd ../kaksha
  cp -R ../lab/. .
  bin/rails test --seed 1
  cp -R ../lab-fixed/. .
  bin/rails test test/integration --seed 1
SH

$ cd ../kaksha
$ cp -R ../lab/. .
$ bin/rails test --seed …
Running 9 tests in a single process (parallelization threshold is 50)
Run options: --seed …

# Running:

F

Failure:
XssTest#test_a_notice_body_is_shown_as_text,_not_as_markup [test/integration/xss_test.rb:6]:
Expected exactly 0 elements matching "div.body b", found 1.
Expected: 0
  Actual: 1

bin/rails test test/integration/xss_test.rb:4

.F

Failure:
CsrfTest#test_a_post_without_a_token_is_refused [test/integration/csrf_test.rb:15]:
`Notice.count` didn't change by 0, but by 1.
Expected: 2
  Actual: 3

bin/rails test test/integration/csrf_test.rb:14

.F

Failure:
MassAssignmentTest#test_a_student_cannot_move_themselves_to_another_centre [test/integration/mass_assignment_test.rb:19]:
the centre was set from a request parameter.
Expected: 7
  Actual: 99

bin/rails test test/integration/mass_assignment_test.rb:16

F

Failure:
MassAssignmentTest#test_a_student_cannot_make_themselves_an_admin [test/integration/mass_assignment_test.rb:13]:
the role was set from a request parameter.
Expected: "student"
  Actual: "admin"

bin/rails test test/integration/mass_assignment_test.rb:10

E

Error:
SqlTest#test_a_search_for_a_surname_with_an_apostrophe_finds_its_notice:
ActiveRecord::StatementInvalid: SQLite3::SQLException: near "Brien": syntax error:
SELECT "notices".* FROM "notices" WHERE (title LIKE '%O'Brien%')
                                                        ^
    app/controllers/notices_controller.rb:7:in 'Enumerable#map'
    app/controllers/notices_controller.rb:7:in 'NoticesController#index'
    test/integration/sql_test.rb:5:in 'block in <class:SqlTest>'

bin/rails test test/integration/sql_test.rb:4

E

Error:
SqlTest#test_a_sort_key_that_is_not_on_the_list_falls_back_to_the_default:
ActiveRecord::StatementInvalid: SQLite3::SQLException: no such column: banana:
SELECT "notices".* FROM "notices" WHERE (title LIKE '%%') ORDER BY banana
                                                                   ^
    app/controllers/notices_controller.rb:7:in 'Enumerable#map'
    app/controllers/notices_controller.rb:7:in 'NoticesController#index'
    test/integration/sql_test.rb:11:in 'block in <class:SqlTest>'

bin/rails test test/integration/sql_test.rb:10

.

Finished in …s, … runs/s, … assertions/s.
9 runs, 10 assertions, 4 failures, 2 errors, 0 skips
[exit status 1]
$ cp -R ../lab-fixed/. .
$ bin/rails test test/integration --seed …
Running 9 tests in a single process (parallelization threshold is 50)
Run options: --seed …

# Running:

.........

Finished in …s, … runs/s, … assertions/s.
9 runs, 16 assertions, 0 failures, 0 errors, 0 skips

# Deliberately weak and for the lab only: never deploy this file.
class NoticesController < ApplicationController
  skip_forgery_protection

  def index
    notices = Notice.where("title LIKE '%#{params[:q]}%'").order(params[:sort])
    render plain: notices.map(&:title).join(", ")
  end

  def show
    @notice = Notice.find(params[:id])
  end

  def new
  end

  def create
    notice = Notice.create!(params.expect(notice: [ :title, :body ]))
    redirect_to notice
  end
end

<%# Deliberately weak and for the lab only: never deploy this file. %>
<h1><%= @notice.title %></h1>
<div class="body"><%= raw @notice.body %></div>