How “../sms” could bypass Authy everywhere

sakurity.com

11 pointshomakov2 comments

Yet another problem that could be solved with good typing :)

Seriously though, it's very worrying to me that so many low-level ruby libraries have so many issues. I realise bugs happen, but at least in the python world there seems to be less "oh whoops the most popular OAuth provider lib is susceptible to CSRF"-type bugs.

But there was no user story in which the user typed "../sms"! You seem to be encouraging thinking about scenarios like this in advance, a.k.a. BDUF.

Reply on news.ycombinator.com