Skip to content

Instantly share code, notes, and snippets.

@andhapp
andhapp / dot.powrc.sh
Created November 17, 2015 22:57 — forked from flarik/dot.powrc.sh
Pow's .porwrc config file for use with RVM's config files .rvmrc or .ruby-version (+ optional .ruby-gemset)
if [ -f "${rvm_path}/scripts/rvm" ]; then
source "${rvm_path}/scripts/rvm"
if [ -f ".rvmrc" ]; then
source ".rvmrc"
elif [ -f ".ruby-version" ] && [ -f ".ruby-gemset" ]; then
rvm use `cat .ruby-version`@`cat .ruby-gemset`
elif [ -f ".ruby-version" ]; then
rvm use `cat .ruby-version`

Researchers investigating the Rails parameter parsing vulnerability discovered that the same or similar vulnerable code had made its way into multiple other libraries. If your application uses these libraries to process untrusted data, it may still be vulnerable even if you have upgraded Rails. Check your Gemfile and Gemfile.lock for vulnerable versions of the following libraries.

Directly vulnerable libraries

rails

Vulnerable: <= 3.2.10, <= 3.1.9, <= 3.0.18, <= 2.3.14

Fixed: 3.2.11, 3.1.10, 3.0.19, 2.3.15

multi_xml

data:text/html, <style type="text/css">#e{position:absolute;top:0;right:0;bottom:0;left:0;}</style><div id="e"></div><script src="http://d1n0x3qji82z53.cloudfront.net/src-min-noconflict/ace.js" type="text/javascript" charset="utf-8"></script><script>var e=ace.edit("e");e.setTheme("ace/theme/monokai");e.getSession().setMode("ace/mode/ruby");</script>

Instrument Anything in Rails 3

With Rails 3.0 released a few weeks ago I've migrated a few apps and I'm constantly finding useful new improvements. One such improvement is the ability to log anything in the same way that Rails internally logs ActiveRecord and ActionView. By default Rails 3 logs look slightly spiffier than those produced by Rails 2.3: (notice the second line has been cleaned up)

Started GET "/" for 127.0.0.1 at Mon Sep 06 01:07:11 -0400 2010
  Processing by HomeController#index as HTML
  User Load (0.2ms)  SELECT `users`.* FROM `users` WHERE (`users`.`id` = 3) LIMIT 1
  CACHE (0.0ms)  SELECT `users`.* FROM `users` WHERE (`users`.`id` = 3) LIMIT 1

Rendered layouts/_nav.html.erb (363.4ms)

[james@kremlin00 ruby (klasscache)]$./ruby -I . -I lib ./test.rb
method cache invalidations: 18
A
B
method cache invalidations: 18
#!/usr/bin/env ruby
gem "parser", "~> 1.4"
require "parser"
require "parser/ruby19"
require "set"
class ConstantDeclarationAndUseProcessor < Parser::AST::Processor
attr_reader :declared, :used
def initialize
module CheapStrings
def `(str)
str
end
end
module A
extend CheapStrings
def self.make_lots_of_strings

This is a proof-of-concept of a couple of concurrent data structures written in Ruby.

The implementations are heavily commented for those interested. There are benchmarks (with results) included below. The results are interesting, but, as always, take with a grain of salt.

Data structures

AtomicLinkedQueue is a lock-free queue, built on atomic CAS operations.

class Foo
public def my_public_method
1 + 2
end
protected def my_protected_method
3 + 4
end
private def my_private_method
This is ApacheBench, Version 2.3 <$Revision: 655654 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/
Benchmarking 127.0.0.1 (be patient)
Server Software: SimpleHTTP/0.6
Server Hostname: 127.0.0.1
Server Port: 5000