### Impact
In the scenario where an attacker might be able to control the href attribute of an anchor tag or
the action attribute of a form tag that will trigger a POST action, the attacker can set the
href or action to " https://attacker.com" (note the leading space) that will be passed to JQuery,
who will see this as a same origin request, and send the user's CSRF token to the attacker domain.
### Releases
The FIXED releases are available at the normal locations.
### Workarounds
To work around this problem, change code that allows users to control the href attribute of an anchor
tag or the action attribute of a form tag to filter the user parameters.
For example, code like this:
link_to params
to code like this:
link_to filtered_params
def filtered_params
# Filter just the parameters that you trust
end
### 参考
* https://groups.google.com/forum/#!topic/rubyonrails-security/XIZPbobuwaY
京公网安备 11010502034610号
暂无评论