You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This post outlines three common web security vulnerabilities with specific examples in Rails. For a more complete list, I highly recommend the OWASP Rails security cheatsheet.
Cross-Site Scripting (XSS)
A cross-site scripting attack is when malicious scripts are injected into a web site in order to compromise it.
For example, let's say we want to allow html tags such as <strong> in our blog comments, so we render raw output using the Rails method #html_safe:
TDD
Test Driven Development. Write examples before implementation.
BDD
Behaviour-Driven Development is about implementing an application by describing its behavior from the perspective of its stakeholders. (The Rspec Book)
RSpec
(mention alternatives, write a simple hand sewn test)
Agile is a general philosophy describing a set of guiding principles for building software through iterative development. Agile development is about providing a framework that allows developers to build something useful for real world users and deal with the realities of interruptions, timelines, and technical requirements that disrupt an ideal development cycle. In other words, Agile development helps developers deal with reality.
SCRUM is a methodology -- in another words, an implementation -- pertaining specifically to project management. Other "Agile" methodologies inclue extreme programming, kanban.
SCRUM history:
Scrum was a term first used in 1987 to describe hyper-productive product development in Japan. The word Scrum comes from rugby, where scrum refers to the strategy used for getting an out-of-play ball back into play. The name Scrum stuck because of the similarities between the game of rugby and the type of product development prosc