Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

How is this a DOS vector? Would passing a symbol instead of a string in the parameters cause the app to crash?


No; the theory behind that attack is, Rails doesn't GC symbols, so you could just repeatedly stuff requests that created new symbols until memory was exhausted. I don't care about that attack (there are others like it), but it's viable.


Symbols are interned and never garbage collected, so if you can cause an app to create arbitrary symbols, you can cause it to use up all the RAM on the machine and throw it into swap, effectively killing its ability to respond to requests in any kind of timely fashion.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: