Out Of Bounds Write in Rails (Python)

Out of bounds write (OOBW) vulnerabilities occur when a program writes data beyond the allocated memory boundaries of a buffer, array, or similar data structure. While Ruby on Rails applications are primarily written in Ruby, many Rails APIs integrate Python-based services for data processing, machine learning, or background tasks—often via microservices, worker queues, or API calls. When these Python components interact with Rails endpoints, improper handling of user-controlled input can lead to OOBW conditions, especially in performance-critical code paths.

Consider a Rails API endpoint that accepts image uploads and delegates resizing to a Python service using Pillow (PIL). If the Rails controller passes user-supplied width and height parameters directly to a Python subprocess without validation, and the Python image processing code uses these values to allocate a buffer or access pixel arrays, an attacker could supply extremely large or negative numbers to trigger an out of bounds write.

For example, a Rails controller might invoke a Python script via subprocess.run() with unsanitized parameters:

# Rails controller (Ruby) - vulnerable
class ImagesController < ApplicationController
  def resize
    width = params[:width].to_i
    height = params[:height].to_i
    result = `python3 /app/resize_image.py #{width} #{height} #{params[:image].path}`
    render json: { result: result }
  end
end

The corresponding Python script (resize_image.py) might naively use these values to create a new image buffer:

# resize_image.py - vulnerable
import sys
from PIL import Image

input_path = sys.argv[3]
width = int(sys.argv[1])
height = int(sys.argv[2])

img = Image.open(input_path)
# Vulnerability: width/height used directly without bounds checking
resized = img.resize((width, height))  # Can cause OOBW if width/height are extreme
resized.save('/tmp/output.jpg')
print('Success')

If an attacker supplies width=-1000000 or height=10000000, the img.resize() call may attempt to allocate memory based on these values, leading to integer overflow, excessive memory consumption, or an out of bounds write when Pillow internally accesses pixel arrays. This could crash the service, corrupt data, or potentially allow arbitrary code execution if combined with other weaknesses.

This risk is amplified in Rails applications that use Python for AI/ML inference (e.g., TensorFlow, PyTorch) where input tensors are shaped by user-controlled parameters. MiddleBrick detects such issues by probing API endpoints with extreme numerical values, negative numbers, and oversized payloads during its Input Validation and Data Exposure checks, flagging potential OOBW conditions in integrated Python components.

Mitigating out of bounds write vulnerabilities in Python components called from Rails requires strict input validation, bounds checking, and safe handling of numerical parameters. The fix must occur at the interface between Rails and Python, ensuring that any user-derived values passed to Python scripts are sanitized and constrained to safe ranges.

First, validate and constrain parameters in the Rails controller before invoking the Python process. Define minimum and maximum acceptable values based on business logic (e.g., image dimensions cannot be negative or exceed 10,000 pixels):

# Rails controller (Ruby) - fixed
class ImagesController < ApplicationController
  MAX_DIMENSION = 10000

  def resize
    width = params[:width].to_i
    height = params[:height].to_i

    # Validate presence and type
    unless width.is_a?(Integer) && height.is_a?(Integer)
      render json: { error: 'Width and height must be integers' }, status: :bad_request
      return
    end

    # Enforce bounds
    if width <= 0 || height <= 0 || width > MAX_DIMENSION || height > MAX_DIMENSION
      render json: { error: