Skip to content

Improve defense mechanisms against tampering protection controls#20

Merged
jorgemanrubia merged 14 commits into
masterfrom
improved-protection
Aug 28, 2021
Merged

Improve defense mechanisms against tampering protection controls#20
jorgemanrubia merged 14 commits into
masterfrom
improved-protection

Conversation

@jorgemanrubia

@jorgemanrubia jorgemanrubia commented Aug 28, 2021

Copy link
Copy Markdown
Member

This includes several improvements to prevent circumventing protection controls:

  • Replace the system to prevent overriding methods in classes. The new one is based on .freeze and it also prevents changing class-level state. A big flaw in the previous approach, based on the method_added hook, is that, while it raised an error, it wouldn't prevent the command from executing (it was evaluated after).
  • Prevent using instance_variable set on core classes.
  • Prevent opening ActiveRecord classes for monkey patching them.
  • Prevent modifying config options once a console session has started.
  • Prevent load sensitive constants dynamically (Console1984, ActiveRecord).
  • Freeze Socket classes and database connection classes to prevent overrides. Also prevent instance-data manipulation for the later.

It also includes a new system for testing tampering cases that should be detected: just place the snippet test/tampering_cases. A test will run for each file and it will fail if it's not detected.

Fix #19

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Bypass protected tables

1 participant