收到警告:拒绝服务

本文介绍了收到警告:拒绝服务的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！ 问题描述 Customer.find(:all, :select => 'id', :order => 'updated_at DESC', :readonly => true, :conditions => { :status_id => Customer.id_for_status(params[:id].to_sym) }, :offset => offset, :limit => 30).collect(&:id)

以上是我的查询，因为我收到类似

Above is my query in that I am getting warning like

Symbol conversion from unsafe string (parameter value) near line 33: params[:id].to_sym

这是拒绝服务的警告.有人知道如何解决此警告吗?

This is the warning of Denial of Service. Anybody have any idea how can I fix this warning?

预先感谢

推荐答案

这里的问题是 params [:id] .to_sym

当要转换为符号的字符串是开放集时，请勿将其转换为符号.创建的每个符号都不会被垃圾回收，并可能导致潜在的内存泄漏，使您的系统容易受到Dos攻击.

When the string which would be converted to symbol is an open set, you should NOT convert them into symbols. Each symbol created will not be garbage collected, and could create potential memory leak which makes your system vulnerable to Dos attacks.

问题在Ruby 2.2中已解决.但仍然-相当白名单列出了将要转换为符号的所有内容.

Problem was resolved in Ruby 2.2. but still - rather white list anything that would be converted into symbols.