Ruby on Rails Risk Assessment & Management 2 — Questions and Answers
Question 1: Which Rails mechanism helps mitigate mass assignment vulnerabilities introduced before Strong Parameters?
- attr_accessible / attr_protected in the model (Correct answer)
- before_action callbacks
- CSRF token validation
- Content Security Policy headers
Correct answer: attr_accessible / attr_protected in the model
attr_accessible and attr_protected were the Rails 3 approach to whitelisting/blacklisting mass-assignable attributes before Strong Parameters replaced them in Rails 4.
Question 2: A Rails app stores session data in cookies. Which risk does this introduce that server-side sessions avoid?
- Client-side tampering if the secret_key_base is compromised (Correct answer)
- Slower response times due to serialization
- Inability to store complex Ruby objects
- Automatic session expiry is not supported
Correct answer: Client-side tampering if the secret_key_base is compromised
Cookie-based sessions are signed with secret_key_base; if that key leaks, attackers can forge arbitrary session data.
Question 3: Which Rails logger setting should be applied in production to reduce the risk of leaking sensitive request parameters in log files?
- config.filter_parameters with sensitive key names (Correct answer)
- config.log_level = :fatal
- config.logger = nil
- config.consider_all_requests_local = false
Correct answer: config.filter_parameters with sensitive key names
config.filter_parameters causes Rails to replace matching parameter values with [FILTERED] in logs, preventing credential leakage.
Question 4: What is the primary risk of using Rails' default development error page (`consider_all_requests_local = true`) in a production environment?
- It exposes full stack traces, source code snippets, and environment variables to end users (Correct answer)
- It prevents the app from booting correctly
- It disables CSRF protection automatically
- It forces all requests through the asset pipeline
Correct answer: It exposes full stack traces, source code snippets, and environment variables to end users
The detailed exception page reveals internal file paths, gem versions, and sometimes environment variables that attackers can exploit.
Question 5: Which Rake/Rails command helps identify outdated gems with known security vulnerabilities in a Rails project?
- bundle audit (Correct answer)
- rails security
- gem outdated --strict
- bundle check --security
Correct answer: bundle audit
The bundler-audit gem's `bundle audit` command cross-references your Gemfile.lock against the Ruby Advisory Database for known CVEs.
Question 6: In a multi-tenant Rails SaaS app, what is the primary risk of using a single database schema without tenant scoping?
- Cross-tenant data leakage if query scopes are omitted (Correct answer)
- Slower ActiveRecord queries due to index overhead
- Inability to run database migrations
- N+1 query problems across tenant records
Correct answer: Cross-tenant data leakage if query scopes are omitted
Without consistent tenant scoping (e.g., via default_scope or a gem like acts_as_tenant), a missing where clause can expose one tenant's data to another.
Question 7: Which HTTP security header, configurable via Rails' `config.action_dispatch.default_headers`, prevents the app from being embedded in an iframe on other domains?
- X-Frame-Options (Correct answer)
- X-Content-Type-Options
- Strict-Transport-Security
- Referrer-Policy
Correct answer: X-Frame-Options
X-Frame-Options set to SAMEORIGIN or DENY prevents clickjacking attacks by blocking cross-origin iframe embedding.
Ruby on Rails Risk Assessment & Management 2
Which Rails mechanism helps mitigate mass assignment vulnerabilities introduced before Strong Parameters?