Ggtcf

Hacking a Safe Lock after 3 tries

If I can solve Sudoku can I solve Travelling Salesman Problem(TSP)? If yes, how?

Define, (actually define) the "stability" and "energy" of a compound

Look at your watch and tell me what time is it. vs Look at your watch and tell me what time it is

Are there verbs that are neither telic, or atelic?

Does Mathematica reuse previous computations?

Why is the President allowed to veto a cancellation of emergency powers?

Welcoming 2019 Pi day: How to draw the letter π?

How to simplify this time periods definition interface?

Is it true that good novels will automatically sell themselves on Amazon (and so on) and there is no need for one to waste time promoting?

Interplanetary conflict, some disease destroys the ability to understand or appreciate music

how to draw discrete time diagram in tikz

An inequality of matrix norm

How to create the Curved texte?

What are substitutions for coconut in curry?

Property of summation

Are ETF trackers fundamentally better than individual stocks?

Sailing the cryptic seas

In a future war, an old lady is trying to raise a boy but one of the weapons has made everyone deaf

A link redirect to http instead of https: how critical is it?

What's the meaning of “spike” in the context of “adrenaline spike”?

How difficult is it to simply disable/disengage the MCAS on Boeing 737 Max 8 & 9 Aircraft?

What approach do we need to follow for projects without a test environment?

Recruiter wants very extensive technical details about all of my previous work

Do I need to use strong params if action doesn't affect models?

0

I'm 80% sure the answer is "no", but I need affirmation.

Case scenario

For controller looking like this:

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

Would it be safe to just pass the params forward like this?

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

Wouldn't user be able to flood server with enormous query, for example?

Documentation only says strong params exist to protect models from malicious mass assignment.

https://edgeapi.rubyonrails.org/classes/ActionController/StrongParameters.html

ruby-on-rails

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  IMO it would still be best to limit what is sent to a third party API, especially if you pay to use the API or the API has any kind of acceptable use policy. Passing params straight through could result in you being banned from the API because you have 1 malicious user that ruins it for you and everyone else.
  
  – engineersmnky
  Mar 7 at 14:34
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  internet is scary place i always prefer to use strong params in my controllers.
  
  – user3775217
  Mar 8 at 10:16
  

  
  
  
  

add a comment | 

0

I'm 80% sure the answer is "no", but I need affirmation.

Case scenario

For controller looking like this:

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

Would it be safe to just pass the params forward like this?

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

Wouldn't user be able to flood server with enormous query, for example?

Documentation only says strong params exist to protect models from malicious mass assignment.

https://edgeapi.rubyonrails.org/classes/ActionController/StrongParameters.html

ruby-on-rails

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

• 
  
  
  

  
  1
  

  
  
  
  
  
  

  
  
  IMO it would still be best to limit what is sent to a third party API, especially if you pay to use the API or the API has any kind of acceptable use policy. Passing params straight through could result in you being banned from the API because you have 1 malicious user that ruins it for you and everyone else.
  
  – engineersmnky
  Mar 7 at 14:34
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  internet is scary place i always prefer to use strong params in my controllers.
  
  – user3775217
  Mar 8 at 10:16
  

  
  
  
  

add a comment | 

I'm 80% sure the answer is "no", but I need affirmation.

Case scenario

For controller looking like this:

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

Would it be safe to just pass the params forward like this?

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

Wouldn't user be able to flood server with enormous query, for example?

Documentation only says strong params exist to protect models from malicious mass assignment.

https://edgeapi.rubyonrails.org/classes/ActionController/StrongParameters.html

ruby-on-rails

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', search_cats_params)
 end

 private

 def search_cats_params
 params.permit(:breed, :ownership, :vaccination, foo: [ :bar, :baz ])
 end
end

class CatController < ApplicationController
 def search_cats
 render json: HTTPClient.new.get('https://api.example.com', params.to_h)
 end
end

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

share|improve this question

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34

asked Mar 7 at 14:04

Steve RedkaSteve Redka

34