Nick Coblentz

Monday, August 30, 2010

Rails 3 HTML Encodes by Default

Rails 3 came out recently, and the developers made a significant change that really improves the security posture of Rails 3. They really embraced the "secure by default" security principle in their efforts to eliminate cross-site scripting. Previously, unsafe user data had to be explicitly HTML encoded in order to avoid cross-site scripting. This was done using the "h" tag. For example:
<%= h(@unsafe_user_input) %>

In Rails 3, the default is to automatically HTML encode. The "h" tag is no longer necessary. Instead, developers must go out of their way to output HTML content to the page using the "raw" tag. For example:
<%= raw(@unsafe_user_input) %>

I think the Rails developers took a really strong stance on this issue and it will result in a safer Ruby on Rails ecosystem.

Please see the video below for more details:
http://rubyonrails.org/screencasts/rails3/xss-ujs

There is also a really great Rails security guide found here:
http://guides.rubyonrails.org/security.html

Friday, July 23, 2010

OWASP AppSec Research 2010 Stockholm Conference Videos Posted!

The presentation videos from the OWASP AppSec Research 2010 Conference in Stockholm, Sweden are now available!

My Presentation slides can be found here:

http://www.owasp.org/images/4/44/OWASP_AppSec_Research_2010_Microsoft_SDL_Agile_by_Coblentz.pdf

A video of the presentation is also available:

http://owasp.blip.tv/file/3918259/

The rest of the videos and presentation slides can be found here:

Martin Holst Swende and Alan Davidson, members of the organizing committee, took pictures at the OWASP AppSec Research 2010 Conference. Those pictures can be found here:

I will be giving this presentation again at the OWASP AppSec Ireleand 2010 Conference on September 17, 2010 (http://www.owasp.org/index.php/OWASP_IRELAND_2010) .

Thursday, June 24, 2010

OWASP AppSec Research 2010 Pictures

The OWASP AppSec Research 2010 Conference in Stockholm, Sweden ended today. I took a quite a few pictures and I thought I would post a couple of them. Please enjoy!