phith0n

『代码审计』小密圈入圈指南

加入代码审计小密圈： https://wx.xiaomiquan.com/mweb/views/joingroup/join_group.html?group_id=2212251881

代码审计小密圈从去年11月成立至今已有近半年时间，一直没有把我们的宗旨和规则明文写出来，一是我比较懒事儿也比较多，二是我发现大家都是善良的小纯白，并没有谁是揣着恶意来到这里，所以这个事儿也不是特别急。但一直没有成文的规定总不是办法，有的新人进来后，四顾何茫茫，不领要旨，可能会觉得钱花的不值。

宗旨

办这个圈子，脑子里有几句话，我一直奉为圭臬，在这里说一下。

cheeaun

RedDotRubyConf 2016 links & resources

📆 Jun 23-24, 2016

🌏 Web site: http://reddotrubyconf.com/ Twitter: http://twitter.com/reddotrubyconf

💁 Ping me @cheeaun on Twitter or leave a comment below if you found some awesome stuff for #rdrc2016. This gist will be updated whenever there's new stuff.

🕙 Previously, on RedDotRubyConf...

dragonjet

Step 1: Server Credentials

This assumes you are now connected to the server via SSH.

• sudo -s Enter root mode for admin access
• groupadd devgroup Create new group to be later granted access to /var/www/html

Creating a new Root User

• useradd -G root,devgroup masterdev Create new root user. Also add to the devgroup
• passwd masterdev Change password for the new root user
• At this point, you'll need to input your new root user's new password

LeCoupa

// XPath CheatSheet
// To test XPath in your Chrome Debugger: $x('/html/body')
// http://www.jittuu.com/2012/2/14/Testing-XPath-In-Chrome/


// 0. XPath Examples.
// More: http://xpath.alephzarro.com/content/cheatsheet.html


'//hr[@class="edge" and position()=1]'                // every first hr of 'edge' class

gampleman

This gist illustrates how you would add Google Analytics tracking into your Rails mailers. Add the tracking_interceptor.rb into your path and enable it for your mailers with:

register_interceptor TrackingInterceptor

tadast

# 1) Create your private key (any password will do, we remove it below)

$ cd ~/.ssh
$ openssl genrsa -des3 -out server.orig.key 2048


# 2) Remove the password

$ openssl rsa -in server.orig.key -out server.key

SabretWoW

# This is a skeleton for testing models including examples of validations, callbacks,
# scopes, instance & class methods, associations, and more.
# Pick and choose what you want, as all models don't NEED to be tested at this depth.
#
# I'm always eager to hear new tips & suggestions as I'm still new to testing,
# so if you have any, please share!
#
# @kyletcarlson
#
# This skeleton also assumes you're using the following gems: 

edubkendo

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>comment</key>
  <string>
  TODO: unresolved issues

  text:

bf4

  gem 'lograge' # more readable logs
    gem 'logstash-event' # for logstash json format
  gem 'mono_logger' # threadsafe logging

nightire

Routes

小心地使用 Match（Rails 3 已实现）

Rails 3 提供了 match 方法供我们自定义 routes，然而我们要小心使用它以避免“跨站脚本攻击”（XSS Attack）。比如像这样的 routes：

注：（r3 代表 Rails 3，r4 代表 Rails 4）

# routes.rb