SQL Injection Vulnerability in Ruby on Rails; affects all versions
I am mostly a Django programmer so excuse my ignorance of rails. How does this keep happening?In Django you would do:Post.objects.get(pk=request.GET['id'])There really is no way to do SQL injection this way.This line in rails looks almost exactly like how you would do it in Django:Post.find_by_id(params[:id])Also this seems really serious. It's not like a edge case where you need to grab a post by id. This is probably a very common use case of that method find_by_id.