This rails guide on security is one of the most comprehensive that I’ve seen on that kinds of attacks that exist against web applications today. While the counter measures that are specified are rails specific, the explanation of the attacks and vulnerabilities are valid for any web stack. This is a must read for anyone that does web development now adays.
Tag Archives: rails
Things I learned this week
In no particular order, a quick run down of some things I learned this week (no particular order):
Ruby / Ruby on Rails
- In Ruby: don’t use f.readlines.each in a loop, as that waits for all output, then iterates. Use f.readline instead, but be prepared to catch the EOF exception when you finish (it’s a documented part of that interface)
- In Ruby on Rails: rss is a valid format (at least in 2.2.2), and can be used in a builder
Mono / C#
- In Mono: File.Exists fails on directories. Even though directories are just special files in Linux, the implementation decided that wasn’t right. Use Directory.Exists instead.
Networking
- IPv6 finally made sense to me, after implementing a 3 site topology for my Network Lab graduate class.
Adding alternating table row colors dynamically with prototype
Alternative table row colors (also known as zebra tables) are very handy. Recently I ran into an issue with redmine where it generates tables in a way that prevents you from tagging the rows as “even/odd” when you create them.
You can fix this after the fact with the following prototype function (redmine is a rails app, so I used prototype, it should be pretty easy to do in jquery as well).
function colorTable() {
var EvenOddCount = 0;
$$(‘.splitcontentleft tr’).each(function(element) {
if(EvenOddCount % 2 == 0){
element.className = “even”;
}else{
element.className = “odd”;
}
EvenOddCount++;
});
}
I use your own css selector where appropriate in the $$ function. Then you can set tr.even and tr.odd in your css file and give it your color scheme. Just set onload=”colorTable();” in your body declaration, and off you go.
Why I love Ruby on Rails… impement a new feature in about an hour
Yes, I’m a fanboy, but with good reasons.
Tonight I decided that I’d really like to add openid support to the MHVLUG Event Calendar. Accounts aren’t used that much in it, because you have to be in the admin role to notice any difference. However, it’s just one less field for me to have to fill in.
So, the 6 million dollar question, what was the duration of time between deciding I’d like to do this (though having no idea how), and having a working implementation…
65 minutes.
Which included getting up to get dinner in the oven.
In blow by blow format:
- A quick bit of googling got me to the openid-authentication railscast, which I watched all the way through.
- I fixed a couple of his refactoring bits to work with newer restful_authentication.
- I also installed an old open_id_authentication plugin the first time, which gave me an exception. Make sure to get the latest on github.
- I modified my user to have my identity_url using the rails console
- I used the rails debugger to figure out that I needed an extra slash on the end of my identity_url, which is why my login with openid wasn’t working
Which is a pretty serious amount of bouncing around because I had no idea what I was doing when I got started. That will turn subsequent openid enablement into a 15 minute exercise.
One step deployment of rails applications with git and passenger
I developed this pattern with mercurial, and have recently adapted it to work with git
Assumed
- You want your production application to be deployed at /data/site/myrailssite on your remote system
- You are running passenger for your rails applications (if you aren’t you should really take a look)
Setting up the production target
First, create a rails user on your production system. This lets your rails app run under a different id than you, or your webserver. Privilege isolation is a good thing.
Next, mkdir /data/site/myrailssite and chown rails /data/site/myrailssite.
Next, su – rails, and cd /data/site/myrailssite && git init
Next, chmod 755 .git/hooks/post-receive
And finally add the following lines to .git/hooks/post-receive.
export RAILS_ENV=production
DIR=`pwd | sed s/.git$//`
cd $DIR && git –git-dir=$DIR/.git –work-tree=$DIR reset –hard && rake db:migrate && touch tmp/restart.txt
Setting your source repo to push to production
On your source repository git remote add production ssh://rails@yourhostname/data/site/myrailssite.
Then, finally git push production master, and you are off. On any future change the push to production will roll the git tree to the newest revision on master, kick off the migrations, and trigger a passenger restart. This is a really handy pattern for making life really easy for deployment, and I’m rolling this through all my project sites as I slowly convert them from mercurial to git.
In praise of github
A few years ago I became sold on distributed source control. Being able to do offline work, try out new ideas cheaply, and throw them away, all were great things. I started with mercurial, but over the summer started using git. A couple of things pushed me over the edge.
- git appeared more modular, at the end of the day this wasn’t really true. The lack of a libgit was actually very disappointing (especially after I had sworn there was one), as I’ve got a number of interesting ideas stalled behind that one.
- the git-svn pluggin, which provides really good 2 way integration between svn and git trees. I’ve stopped making anon svn clones, I now do a git-svn clone. If I want to fix something locally, I can now version that fix.
- github – free social hosting of git trees
Github helps you over the hump in publicly hosting git trees. Honestly, the hump isn’t very high, but the documentation out there could be a bit more straight forward. I’d been chugging along using github for all my random open source projects, some that are active, some which are stalled. But the source code is out there for others to take a look at. Github provides nice instructions for people to clone the work, and run with it. It’s definitely a prettier interface.
Github really started to shine for me this past weekend though. I was looking for ical generation code for ruby to replace an email tool that I wrote in perl for our MHVLUG monthly meeting emails. There exists 2 ruby ical projects, vpim and icalendar, neither of which support timezones in the ical generation, and both with pretty inactive mailing lists. Once it became clear that the problem was not solved, I decided to dig in and see if I could come up with something workable.
But once you go social, github really shines
There had been a post on the icalendar devel list a few months back that said he had fixed a couple of timezone issues and provided a github url. I cloned that project, and realized that while it got closer to what I needed, it still didn’t quite do what I needed. So I clicked the fork button.
I was now given my own fork of the icalendar source. But more importantly, it also showed me all the other forks on github, which there were 5 others. I made my fixes, pushed them back public, and then proceeded to start to accumulate up some of the other changes out there. There is even a fork queue which shows all the outstanding changes in other forks out there, as well as odds on whether or not the patches will apply.
While you could figure all this out on your own with the command line, that kind of discovery and view is really a help and a timesaver.
And it’s even better if you are doing ruby
Github is written in ruby, though I’m not sure on the framework behind it. As an added bonus to people hosting ruby code on the site, the team created a gem build service into github. You add a specially formatted gem spec file to your github tree, and you’ll get a gem built on each checkin. My 2 ruby libraries that are there now are configured to build gems, easy for all to install.
If you haven’t checked out git, or github, you should. While I found the learning curve on git to be higher than I really wanted to deal with, the community is very active, and the number of things that support git now is quite high. Rails generators even support git now, automatically source managing via git or svn if you ask them to. Github popped out of no where in 2008, and I can’t wait to see where they are going to go in 2009.
Weekend Rails Hacking
For the past 4 years I’ve been using evite to manage the RSVPs for our memorial day weekend party. Given that it’s a pretty large scale pot luck event, it’s helpful to have a system where people can respond with a message that others can see. The reduces my need to field “what should we bring” questions, as you can easily see what everyone else is bringing and react accordingly.
Evite sucks. While it doesn’t force attendees to make accounts, it makes it look like it does. The evite.com emails tend to catch as spam. And the interface is now dubious under firefox. The idea is still good, but it hasn’t really ramped with the trends in the rest of the service web application space.
One of the key things I wanted in an evite replacement is getting rid of user logins. Given an event, and an email address, you can come up with a unique key that qualifies that person for that event. That means the user just follows a link, and they are in. Links are unique for people. If you make the key a hash of the person’s email and some secret seed key for the event, you’ve got something cryptographically strong as well. No one can modify another person’s entry because the key needs to match before you get any info.
Saturday was a rainy day, so I built this system. By Saturday night I had most of it working, and had rolled this out live by Sunday afternoon. This was my first rails 2.0 app, so I needed to catch up on a few things along the way. Things I learned:
- Rails 2 creates scaffolds in a slightly new way. That threw me for a bit, as I had already built models for most of my objects before creating scaffolds. The new way (putting attributes on the command line) looks like it is designed to make rails tooling easier.
- ActionMailer is crazy easy. It even does multipart mixed emails really easily. My mhvlug mailer script for month announcements is going to need to be converted to this at some point.
- Rails has a word_wrap function in the view context. Of course it does, why did I even doubt that.
- The google maps API is impressive. I had maps based on event location within 60 minutes of signing up for my Google Maps API key.
- The f= param on maps.google.com is which fuction to drive. q: location query, d: directions. That took a little bit of reading urls to realize.
- It’s pretty easy to integrate mercurial push to auto restart a rails app if it’s running under passenger.
- If you are running multiple versions of rails applicatoins under passenger, delete all the rails links in vendor/ so that it picks up the right rails environment.
- arround_filter in rails is really handy to catch generic exceptions and dump people off to an error page that isn’t the default rails one.
All in all, I was really happy how this turned out. As soon as I get some free time I’ll genericize the bits of the app that I coded just for our event, and get this out on rubyforge. I only wish there was a rails equiv of gems, as I’ve still found that it isn’t entirely clear how to best package a rails application as an easy to download open source component.
It's always more complicated 