Ruby on Rails Risk Assessment & Management 5 — Questions and Answers
Question 1: What is the primary risk of storing sensitive user data (e.g., SSNs, credit card numbers) in plain text in a Rails PostgreSQL database?
- A database breach directly exposes all sensitive data with no further attack steps needed (Correct answer)
- ActiveRecord query performance degrades for large text columns
- Rails migrations fail to run on encrypted PostgreSQL extensions
- Devise password hashing is bypassed for those columns
Correct answer: A database breach directly exposes all sensitive data with no further attack steps needed
Plain-text sensitive data means a single database read or backup theft yields immediately usable information with no decryption required.
Question 2: Which risk does an unvalidated file upload feature in Rails introduce if uploaded files are served from the same origin as the app?
- Stored XSS or web shell execution if the server processes uploaded HTML, SVG, or script files (Correct answer)
- ActiveStorage attachments overwriting the Rails public/ directory index
- Puma worker crashes due to large multipart form parsing
- Database connection exhaustion from concurrent upload transactions
Correct answer: Stored XSS or web shell execution if the server processes uploaded HTML, SVG, or script files
Serving attacker-uploaded HTML or SVG files from your origin allows JavaScript execution in victim browsers under your domain's trust context.
Question 3: What risk does a Gem with an unpatched CVE in your Gemfile.lock represent beyond the vulnerability itself?
- The vulnerable code is deployed into production until the Gemfile.lock is updated and redeployed, extending the exposure window (Correct answer)
- Bundler will refuse to install other gems until the CVE gem is removed
- Rails boot will raise a Gem::LoadError preventing the application from starting
- The CI pipeline will automatically downgrade the gem to the last safe version
Correct answer: The vulnerable code is deployed into production until the Gemfile.lock is updated and redeployed, extending the exposure window
Gemfile.lock pins exact versions, so the vulnerable gem persists in all environments until a developer explicitly updates and redeploys.
Question 4: Which risk does inadequate input validation on a Rails Active Job argument introduce?
- Attackers who can enqueue jobs may inject malicious payloads that execute with background worker privileges (Correct answer)
- Sidekiq fails to serialize large arguments, causing job queue corruption
- ActiveRecord callbacks are skipped for records created inside jobs
- The job class name is exposed in the Sidekiq web UI to unauthenticated users
Correct answer: Attackers who can enqueue jobs may inject malicious payloads that execute with background worker privileges
Background workers often run with elevated permissions and less request-cycle security context, making unvalidated job arguments a high-impact injection vector.
Question 5: In Rails, what security risk does using `render inline:` with user-supplied content introduce?
- Server-Side Template Injection (SSTI), allowing arbitrary Ruby code execution via ERB tags in the input (Correct answer)
- Double-rendering errors that crash the Puma thread handling the request
- Turbo Frame responses being sent to wrong DOM targets
- CSS style sheets being inlined into the HTML response unescaped
Correct answer: Server-Side Template Injection (SSTI), allowing arbitrary Ruby code execution via ERB tags in the input
render inline: evaluates the string as an ERB template; user-supplied <%= %> tags execute arbitrary Ruby on the server.
Question 6: What risk does relying solely on client-side validation (e.g., HTML5 required attributes or JavaScript) for security-critical input in a Rails app introduce?
- Attackers can bypass client-side checks entirely by sending crafted HTTP requests directly to the server (Correct answer)
- Rails model validations become redundant and are automatically disabled
- ActionController strong parameters stop filtering unpermitted keys
- The browser fails to submit the form when JavaScript is disabled
Correct answer: Attackers can bypass client-side checks entirely by sending crafted HTTP requests directly to the server
Client-side validation is easily circumvented with tools like curl, Burp Suite, or browser DevTools, making server-side model validations the authoritative security gate.
Question 7: Which risk does enabling verbose SQL logging in a Rails production environment introduce?
- Sensitive query parameters and data values may be written to log files accessible to system administrators or log aggregation services (Correct answer)
- ActiveRecord query plan caching is disabled, causing full table scans
- The Rails router logs duplicate entries for every SQL statement issued
- Puma worker threads block waiting for the logger mutex under high load
Correct answer: Sensitive query parameters and data values may be written to log files accessible to system administrators or log aggregation services
Production SQL logs can capture PII, search terms, or inferred user behavior, creating a data exposure risk if logs are not adequately protected.
Ruby on Rails Risk Assessment & Management 5
What is the primary risk of storing sensitive user data (e.g., SSNs, credit card numbers) in plain text in a Rails PostgreSQL database?