Is it safe to accept URL parameters for populating the `url_for` method?

前端 未结 3 485
春和景丽
春和景丽 2021-01-19 21:39

I am using Ruby on Rails 4.1.1 and I am thinking to accept parameters (through URL query strings) that are passed directly to the url_for method, this way:

3条回答
  •  有刺的猬
    2021-01-19 22:42

    It's not exactly an answer, just wanted to point out that you shouldn't use something like

    url_for(params)
    

    because one could pass host and port as params and thus the url could lead to another site and it can get worse if it gets cached or something.

    Don't know if it threatens anything, but hey, it's worth pointing out

提交回复
热议问题