Unsafe parameter value in link_to href

Question

I have added the following line to a template file

link_to("CSV", params.merge(:action => "list", :format => :csv, :filename => filename)

A security assessment tool showed the warning that there is a cross scripting vulnerability asscociated with this.I need to know

1)Why such a vulnerability occur? 2)What is the solution to this problem?

Answer 1

I dont think there's a need to merge :format and :filename into params. This will lead two major complications.

1. Someone can modify the querystring, leaving doors to security vulnarability.
2. Having userdefined symbols at runtime and merging them with params, also leaves a door for DoS(Denial of Service) attack.

(you may google about these issues for detailed explanation)

Focusing on what you can do to solve this issue is

link_to("CSV", :action => "list", :format => :csv, :filename => filename)

or if it is in other controller

link_to("CSV", :controller => "controller_name", :action => "list", :format => :csv, :filename => filename)

This might help you resolve the issue.

Good luck.