even with whitelist there is a DoS attack vector about rack-mini-profiler HOT 2 CLOSED

Sure, that sound fine to me, let's get it done soon cause I would like to
get another release out for it.

On Sat, Nov 23, 2013 at 8:53 AM, Brian Palmer [email protected]:

It's trivial for somebody to craft a cookie so that
client_settings.has_cookie? will return true. While this won't allow them
to view the profiling information without MiniProfiler.request_authorized?also being true, it'll still cause rack-mini-profiler to gather the
profiling information, which could be utilized to increase the severity of
a DoS attack, especially with gc profiling.

One quick fix would be to only allow pp=enable to take effect if
MiniProfiler.request_authorized? , so I could push a pull request for
that, but it doesn't solve the issue for people who don't use config.enabled
= false.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/30
.

from rack-mini-profiler.

see #31 for the pull request

from rack-mini-profiler.