assaf/vanity — pull request #236 by modosc (2014-11-21 23:04:09+00:00)
Title: don't suggest using insecure wildcard routes

the install instructions include adding an insecure wildcard route which opens up an attack vector.

match '/vanity(/:action(/:id(.:format)))', :controller => :vanity, :via => [:get, :post]

assume that the vanity controller is protected in some way (password, session, etc) - if i can trick an authenticated user into viewing some html i can cause him/her to call ````#complete````, ````#chooses````, or ````#add_participant```` via GET with any values i specify:

this will also bypass CSRF protection if the host application has it enabled.

quick fix is to change the docs (ie, this pull request) - better fix is to make vanity into a rails engine and then write these routes in directly yourself.