Rails security fixes 2.3.10, 3.0.1 released | Hacker News

This looks really bad.The ActiveRecord ORM supports URL patterns that reference attributes across associations. So if you have a "user" with a 1:1 relationship with an "account", you can craft a URL with parameters that directly reference the "account" for your "user". It turns out Rails has special logic for the case where those parameters include an "id": it looks like Rails will find whatever a

[willnet]

2.3.9または3.0.0でnested_attributesを使っているときに、関連先のidをupdateすることができてしまうみたいね