Innovation and Security in Ruby on Rails

Ruby on Rails
Innovation and Security

Tillmann Bielefeld 1

In 2001
2 Rails - Innovation and Security

"01a4" != "001a4"
"01e4" == "001e4"

I started hacking

"01a4" != "001a4"
"01e4" == "001e4"

"01e4" == "10000"

I started hacking

2006 - 2008

Too many...

Layers

Discussions

Stack Traces

! at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:192) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1001) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:250) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:149) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:111) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.Server.handle(Server.java:360) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:454) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:890) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:944) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716
! at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:630) [jetty-http-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:230) [jetty-http-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:77) [jetty-server-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:622) [jetty-io-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:46) [jetty-io-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:603) [jetty-util-8.1.5.v20120716.jar:8.1.5.v20120716]
! at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:538) [jetty-util-8.1.5.v20120716.jar:8.1.5.v20120716]
! at java.lang.Thread.run(Thread.java:680) [na:1.6.0_31]
Caused by: org.springframework.dao.InvalidDataAccessApiUsageException: [Assertion failed] - this argument is required; it must not be null; nested exception is java.lan
failed] - this argument is required; it must not be null
! at org.springframework.orm.jpa.EntityManagerFactoryUtils.convertJpaAccessExceptionIfPossible(EntityManagerFactoryUtils.java:301) ~[spring-orm-3.1.2.RELEASE.jar:3.1
! at org.springframework.orm.jpa.vendor.HibernateJpaDialect.translateExceptionIfPossible(HibernateJpaDialect.java:106) ~[spring-orm-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at org.springframework.dao.support.ChainedPersistenceExceptionTranslator.translateExceptionIfPossible(ChainedPersistenceExceptionTranslator.java:58) ~[spring-tx-3.
! at org.springframework.dao.support.DataAccessUtils.translateIfNecessary(DataAccessUtils.java:213) ~[spring-tx-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:163) ~[spring-tx-3.1.2.RELEASE
! at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) ~[spring-aop-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at org.springframework.data.jpa.repository.support.LockModeRepositoryPostProcessor$LockModePopulatingMethodIntercceptor.invoke(LockModeRepositoryPostProcessor.java
jpa-1.2.0.M1.jar:na]
! at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:90) ~[spring-aop-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) ~[spring-aop-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at $Proxy44.findByNameStartsWith(Unknown Source) ~[na:na]
! ... 46 common frames omitted
Caused by: java.lang.IllegalArgumentException: [Assertion failed] - this argument is required; it must not be null
! at org.springframework.util.Assert.notNull(Assert.java:112) ~[spring-core-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at org.springframework.util.Assert.notNull(Assert.java:123) ~[spring-core-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at org.springframework.data.jpa.repository.query.ParameterMetadataProvider$ParameterMetadata.prepare(ParameterMetadataProvider.java:156) ~[spring-data-jpa-1.2.0.M1
! at org.springframework.data.jpa.repository.query.CriteriaQueryParameterBinder.bind(CriteriaQueryParameterBinder.java:68) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.ParameterBinder.bind(ParameterBinder.java:108) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.PartTreeJpaQuery$CountQueryPreparer.invokeBinding(PartTreeJpaQuery.java:196) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.PartTreeJpaQuery$QueryPreparer.createQuery(PartTreeJpaQuery.java:121) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.PartTreeJpaQuery.doCreateCountQuery(PartTreeJpaQuery.java:82) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.AbstractJpaQuery.createCountQuery(AbstractJpaQuery.java:148) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.JpaQueryExecution$PagedExecution.doExecute(JpaQueryExecution.java:99) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.JpaQueryExecution.execute(JpaQueryExecution.java:55) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.AbstractJpaQuery.doExecute(AbstractJpaQuery.java:95) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.jpa.repository.query.AbstractJpaQuery.execute(AbstractJpaQuery.java:85) ~[spring-data-jpa-1.2.0.M1.jar:na]
! at org.springframework.data.repository.core.support.RepositoryFactorySupport$QueryExecutorMethodInterceptor.invoke(RepositoryFactorySupport.java:313) ~[spring-data
! at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:110) ~[spring-tx-3.1.2.RELEASE.jar:3.1.2.RELEASE]
! at org.springframework.dao.support.PersistenceExceptionTranslationInterceptor.invoke(PersistenceExceptionTranslationInterceptor.java:155) ~[spring-tx-3.1.2.RELEASE

Stack Traces
! ... 53 common frames omitted


$ irb
> a
ruby-1.9.3-p0 :045 > a
NameError: undefined local variable or method `a' for main:Object

ruby-1.9.3-p0 :046 > b
NameError: undefined local variable or method `b' for main:Object

ruby-1.9.3-p0 :047 > a = b

ruby-1.9.3-p0 :048 > a = a

... ?

2004

$ irb
> a
ruby-1.9.3-p0 :045 > a
NameError: undefined local variable or method `a' for main:Object

ruby-1.9.3-p0 :046 > b

ruby-1.9.3-p0 :047 > a = b

ruby-1.9.3-p0 :048 > a = a

... ?
=> nil

2004

2004

page.replace_html('tasks',
Task.completed_count)

page.visual_effect(:highlight,
'tasks',
:duration => 1.0)

.rjs

Remote Javascript

class
Role
<
ActiveRecord::Base

attr_accessor
:name

has_and_belongs_to_many
:clients
end

class
Client
<
ActiveRecord::Base

:roles
end

Active Record

class
Role
<
ActiveRecord::Base

attr_accessor
:name

:clients
end

class
Client
<
ActiveRecord::Base

:roles
end
client_roles
1 0..* client_id 0..* 1
Client role_id Role
name

Active Record

class
Role
<
ActiveRecord::Base

attr_accessor
:name

:clients
end

class
Client
<
ActiveRecord::Base

:roles
end
client_roles
1 0..* client_id 0..* 1
Client role_id Role
Magic!
name

Active Record

class
Role
<
ActiveRecord::Base

attr_accessor
:name

:clients
end

Metaprogramming

class
Role
<
ActiveRecord::Base

attr_accessor
:name

:clients
end

Role.find_or_create_by_name("admin")

Metaprogramming

class
Role
<
ActiveRecord::Base

attr_accessor
:name

:clients
end


def
method_missing(m,
*args,
&block)

#
magic
end

Metaprogramming

class
Role
<
ActiveRecord::Base

attr_accessor
:name

:clients
end


def
method_missing(m,
*args,
&block)

#
magic
end
Magic!

Metaprogramming

2008 , Kiel

2009

2013

Innovation


Packet Management

$
gem
install
rails
$
rails
server


source
"http://rubygems.org"
gem
"json"
gem
"rails"
Gemfile gem
"empuxa-‐deploy"

$
bundle
install
$
bundle
exec
script/rails

Dependency Management

en_EN.yml

i18n

launch.slogan1
en_EN.yml

i18n

i18n_viz Gem

$
cap
deploy
<code>

Capistrano Deployment

$
cap
deploy
<code>

$
cap
staging
deploy staging


$
cap
deploy
<code>

$
cap
staging
deploy staging
$
cap
production
deploy

production


$
cap
deploy:migrations

v1
-‐>
v2


$
cap
deploy:migrations

v1
-‐>
v2

current
shared
releases

20130128231601

20130129231801

20130129161601 current


$
cap
deploy:migrations

v1
-‐>
v2

$
cap
deploy
rollback
current
shared
releases

20130128231601

20130129231801 current

20130129161601 current


class
User
<
ActiveRecord::Base

devise
:database_authenticatable,

:registerable,
:recoverable,

:rememberable,
:trackable,
:validatable
end

Devise

<div
id='content'>

<div
class='left
column'>

<h2>Welcome
to
our
site!</h2>

<p><%=
print_information
%></p>

</div>

<div
class="right
column">Right</div>
</div>

HAML Views

<div
id='content'>

<div
class='left
column'>

<h2>Welcome
to
our
site!</h2>

<p><%=
print_information
%></p>

</div>

<div
class="right
column">Right</div>
</div>

#content

.left.column

%h2
Welcome
to
our
site!

%p=
print_information

.right.column

Right

HAML Views

link_to_remote
"delete",

:confirm
=>
:true

:url
=>
delete_post(post.id)

Ajax

link_to_remote
"delete",

:confirm
=>
:true

:url
=>
delete_post(post.id)

unobstrusive
<a
href="/posts/2"
class="delete_post"
data-‐
confirm="Are
you
sure?"
data-‐
method="delete"
data-‐
remote="true"
rel="nofollow">Delete</a>

Ajax

Admin Interfaces

def
index

fancygrid_for
:users
do
|g|

g.attributes
:id,
:username,
:email

g.ajax_url
=
users_path

g.find

end

end

Frontend Ajax Tables

RESTful APIs

Security


SQL Injection?

class
Role
<
ActiveRecord::Base

attr_accessor
:name
end

User.find_by_name(

"Robert');
DROP
TABLE
Students;
-‐-‐")

SQL Injection. Solved.

Cross Site Request Forgery

- RSpec
- Jenkins
- Minitest

Automated Tests

Quality Assurance

$
cd
my_rails_app
$
gem
install
brakeman
$
brakeman
-‐o
report.html

brakeman

Fast Patching

User.find_by_id(
{:select
=>"*
from
users
limit
1
-‐-‐"})

SELECT
*
from
users
limit
1
-‐-‐
FROM
"users"
WHERE

"users"."id"
IS
NULL
LIMIT
1

=>
#<User
id:
1,
all
other
attributes

Security Leak, Jan 3rd

Email from Heroku

This

Morning!

Email from Heroku

The Community


Number
of
Developers

Low High

Programming Experience

Number
of
Developers

Low High

Programmers

Number
of
Developers

Low High

PHP

Number
of
Developers

Entry Barriers?!

Low High

Ruby

• Strong community

Asking Developers

• Strong community
• Simple magic
• Eats resources
• Enterprise ready
• Hosting is either hard or expensive
• Open + Innovative + Secure

Asking Developers

MIT
Licence
Openness + Connectivity

• Longest Stack Trace ever: https://gist.github.com/1078370

• Burger Picture: Epic Mealtime

• http://brakemanscanner.org/

• http://www.railshosting.org/

• capistrano.org

• http://www.globalnerdy.com/2012/01/28/wat-a-funny-
look-at-ruby-and-javascript-oddities/

• http://www.optimum7.com/internet-marketing

References

Innovation and Security in Ruby on Rails

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (9)

Semelhante a Innovation and Security in Ruby on Rails

Semelhante a Innovation and Security in Ruby on Rails (20)

Último

Último (20)

Innovation and Security in Ruby on Rails