Ruby on Rails Risk Assessment & Management 4

Question 1

What is the risk of using `find_by_sql` or `where` with string interpolation of user input in Rails ActiveRecord?

Accepted Answer

SQL injection, allowing attackers to manipulate or exfiltrate the database

Answer

String interpolation bypasses ActiveRecord's parameterized query sanitization, directly embedding user input into SQL statements.

Question 2

Which risk does enabling `config.assets.compile = true` in a Rails production environment introduce?

Accepted Answer

Increased CPU/memory load and potential DoS from on-demand asset compilation per request

Answer

Live asset compilation is expensive; if triggered per request under load, it can exhaust CPU and memory, effectively causing a denial of service.

Question 3

In Rails, what is the risk of using `protect_from_forgery with: :null_session` instead of `:exception` on non-API controllers?

Accepted Answer

CSRF attacks silently succeed with a blank session rather than being rejected

Answer

:null_session only clears the session on a CSRF mismatch instead of raising an error, meaning forged requests can still partially succeed.

Question 4

What security risk is associated with using `send` or `public_send` with user-controlled method names in a Rails controller?

Accepted Answer

Attackers can invoke arbitrary public methods on the object, including dangerous ones like destroy or system calls

Answer

Allowing user input to select the method name via send gives attackers control over which methods execute, potentially triggering destructive actions.

Question 5

Which risk does an overly permissive CORS configuration (e.g., `origins '*'`) in a Rails API-only app create?

Accepted Answer

Any website can make authenticated cross-origin requests using the victim user's credentials

Answer

A wildcard CORS origin combined with credentials: true allows malicious sites to issue API requests on behalf of logged-in users.

Ruby on Rails Practice Test

Ruby on Rails Practice Test

Ruby on Rails Risk Assessment & Management 4