Skidoosh

Rails, the mass assignment exploit, devs and GitHub. Who’s to blame?

Glyn Mooney — Sun, 11 Mar 2012 19:59:18 +0000

With the recent rails security concerns raging through the interwebs I thought I’d put my 2p in about what’s been said (not the mud-slinging from the trolls trying to get a rise).

Firstly, who’s to blame. In short, nobody and everybody. I’d like to start with a comparison application, postfix. Postfix makes one assumption “I’m in a hostile environment”. Pretty reasonable assumption in my opinion, it’s a service on a network that accepts user input. Ruby on Rails is a web framework that is available on a network in app form as a service and accepts user input.

I know postfix is an application and rails is a framework but it’s a fair comparison. Rails on this particular point, this particular point being the mass-assignment exploit (which is compatible in scale and severity to register globals in PHP) raised by @hamakov over at GitHub here(where everyone was warned). But the rails team chose to allow all input to be accepted by default and left the developer with two options, blacklist or whitelist data being passed to the model. Rails won’t even complain if you choose to leave your application wide open.

But still the rails team provided the method to secure your models, therefor not their fault. But still I’d hope for future releases they blacklist all input by default and leave it to the developer to open it rather than close it. It’s a pain in the back-side but it’s only a few lines of code.

Now on to the developers. Most devs as stated in the bug report, are low to medium level and may not be aware of this issue, so again, not their fault. This being said I’d like to think in situations like this, I’d be protected by the framework from my own stupidity, as even the best of us make epic mistakes that even tests can’t protect us from.

Now on to GitHub. They were warned of the issue but left it until @hamakov fired a shot across their bow, and then fixed it, in an hour. This issue was raised three days prior to the “statement” by @hamakov.

Lots of people are praising them for there response to this issue, but, this is an amazing service with lots of users who trust them unequivocally. And GitHub have been on the first to roll out patches to protect users to issues as large as a flaw in HTTP itself. So why not this time?

Just incase anyone interpreters this as poo slinging, it’s not. It’s just my thoughts on the matter now the dust has settled. I’d really like to hear what the rest of you think?

The Best Software License I’ve Ever, Ever Seen!

Glyn Mooney — Sun, 15 May 2011 10:19:06 +0000

I just saw this over on the Github’s and had to share it with the rest of the world!

DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
Version 2, December 2004

Copyright (C) {the year} {your name}
Everyone is permitted to copy and distribute verbatim or modified
copies of this license document, and changing it is allowed as long
as the name is changed.

DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION

0. You just DO WHAT THE FUCK YOU WANT TO.

Hope this… Helps :D

Who you gonna call? Rails Hotline!

Glyn Mooney — Thu, 28 Apr 2011 17:22:31 +0000

When there’s something strange in your ruby app. Who you gonna call? Rails Hotline! Yes! A Ruby on Rails hotline! For free!

If you’ve ever been stuck in a rut and Stackoverflow just doesn’t cut it, now you have a free community led support line to call to help rid you of your Rails woes. The Rails Hotline is a free phone support line, staffed by members of the Rails community to help you out when you’re in a pickle.

There are a few members on at a time so don’t go nuts! So rather than calling the Samaritans when you’re on the edge of sanity, call (877) 817-4190!

Another good reason to love open source! Unlike this guy http://bit.ly/iJB0sG

Remove the natural padding from images (img) with CSS

Glyn Mooney — Wed, 27 Apr 2011 19:16:38 +0000

Time for another CSS quick tip! I see this question crop up a lot over at stackoverflow, and it’s to do with the natural padding associated with the tag. If you don’t use a good CSS reset you’ll notice that all your images have a four pixel padding at the bottom of them. This is how to remove it:

img { vertical-align: top /* can be baseline */ }

Hope this helps!

Django 1.3 Released

Glyn Mooney — Wed, 23 Mar 2011 18:14:14 +0000

As you may have have discovered the eagerly awaited iteration of Django 1.3 has finally been released. The major focus of this release has been long standing feature requests, bug fixes and additions to current features. So without any further ado, lets run through them.

New Django 1.3 Features

Class based views
Framework support of the Python logging module
A new contribution for handling static media (images, javascript, css, etc.) now with netter support for CDN delivery out of the box
Support for the Python 2.7 unittest2
If your Python install is version 2.5 and above you’ll have access to the new transaction management functionality, similar to the .NET NHibernate
Configurable delete cascade functionality like Ruby on Rails Activerecord
Improvements to the current template tags. The load tag supports importing and loading from libraries, include allows the inclusion of extra context variables and the exclusion of the current context
A new TemplateResponse class to allow HTTP Responses to be withheld and changed later in the response process
An improved caching infrastructure
Support to grant permissions on inactive users. This will be useful if you require a user to access account information after authentication, or you just want to show them the account is awaiting activation
Django 1.3 ships with the GeoDjango test suite
MEDIA_URL and STATIC_URL settings must end with a slash! This is important if you intend to upgrade

To get the full list of changes (including the all important deprecation list) head over to the change list in the Django 1.3 documentation http://docs.djangoproject.com/en/dev/releases/1.3/

My Top Web Developer Podcasts

Glyn Mooney — Tue, 22 Mar 2011 10:02:27 +0000

The Ruby Show (Ruby General)

Presented by Peter Cooper (of Beginning Ruby fame) and Jason Seifer, bringing you the latest Ruby and related news on a weekly basis. Head over to http://rubyshow.com/ to find out more!

From Python Import Podcast (Python General)

Presented by Chris Miller, David Stanek, Mike Crute, Mike Pirnat, Ben Smith, Dan Buch. This is a less frequent podcast, containing all best Python news, event, tools and rants from the guys. Check out http://frompythonimportpodcast.com/ for more information.

Think Vitamin Radio (Web General)

From the people who brought us Carsonified and Think Vitamin, Keir Whitaker, Ryan Carson and Mike Kus band together to bring news, events and interesting information to the masses! Go to http://thinkvitamin.com/podcast/ for the full story.

The Big Web Show (Web and Other)

Hosted by Dan Benjamin and Jeffery Zeldman, The Big Web Show is all about the web and other areas of interest. It’s just one of the many great shows brought to us from 5by5 (The Ruby Show being one of these). Just pop over to http://5by5.tv/bigwebshow or http://5by5.tv/ to see all the other great shows they have!

Sitepoint (Web General)

This is a great (weekly) show hosted by Kevin Yank and Louis Simoneau and is full of the latest news, trends, features and things you didn’t know you didn’t know! A must listen in my humble opinion! http://blogs.sitepoint.com/category/podcast/.

Hanselminutes (.NET and Web General)

I really enjoy this one. Hosted by Scott Hanselman of .NET fame. The show is full of mainly .NET topics, but does spill over to some nice web orientated show’s. The main thing I like about this show is, Scott asks really good questions! By this I mean as if he knew nothing so you learn a lot from this one! Head over there now for more info http://www.hanselminutes.com/.

Railscasts (Ruby on Rails)

This is a weekly video podcast of Ruby on Rails specific tutorials and how to’s. This is a great way to get started in the rails world to! http://railscasts.com/ or in plain text tutorials at http://asciicasts.com/.

Workers of the Web (Web and other wonderful stuff)

This is my favorite! A little more infrequent (2 weeks to a month at a time), the show is jam packed full of news, tips events and other eye candy! Head over to http://workersoftheweb.com/ to see a treasure trove of Awsomesauce!

WordPress JPEG Thumbnail Image Quality Setting and Adjustment

Glyn Mooney — Mon, 21 Mar 2011 15:18:21 +0000

Well, I had to do some digging around deep in the WordPress internals for this one! If you want to set the image quality of the thumbnails from the “the_post_thumbnail” function/template tag add the following line to your functions.php file to override the default value of 90%:

add_filter('jpeg_quality', function($arg){return 100;});

On some production environments you may get a “unexpected T_FUNCTION” error (older versions of PHP 5 don’t like anonymous functions). In this situation go for the following:

function jpeg_quality_callback($arg)
{
return (int)100;
}

add_filter('jpeg_quality', 'jpeg_quality_callback');

Here I’m setting the quality to 100%, but you can set it to whatever value suits your project. You have to set the “$arg” to swallow the argument that get’s passed to the original function in the “image_resize” function in the media.php file.

Hope this helps! Leave a comment if it did!

Mozillas Web O(‘pen) Wonder

Glyn Mooney — Fri, 18 Mar 2011 11:19:28 +0000

Mozilla Firefox 4 & The Web O('pen) Wonder

Mozilla launch the “Mozilla Firefox 4 & The Web O(‘pen) Wonder”. An HTML 5 showcase of the capabilities of the up-coming and eagerly awaited Firefox 4 browser.

To see the site in all it’s web glory you’ll need the Firefox 4 beta or Googles’ Chrome 9 (no mention of Safari or IE….). You’ll be wowed and amazing, boys and girls by feats of amazing Web Fonts, CSS Animations, HTML 5 video and as if that wasn’t enough, some WebGL too!

What are you waiting for! Go see the 8th wonder of the world!

How to reset the Webkit HTML5 search field style with CSS

Glyn Mooney — Thu, 17 Mar 2011 10:57:04 +0000

I’ll keep this one short and snappy! I just ran into an issue where the new HTML5 search field would take the browser default styles over what I had defined. With a little Googling around and some tweaks, I came up with the following:

input[type=search]::-webkit-search-decoration,
input[type=search]::-webkit-search-cancel-button,
input[type=search]::-webkit-search-results-button,
input[type=search]::-webkit-search-results-decoration {
display: none;
}

input[type=search] {
/* the webkit overrides need to stay at the top */
-webkit-appearance: textfield;
-webkit-box-sizing: content-box;
/* your styles here */
}

Hope this helps someone! Leave a comment, if you know a better way and I’ll update the article!

Optimize your MySQL queries to fine tune your application

Glyn Mooney — Sat, 12 Jun 2010 09:08:31 +0000

As applications are getting more complex and manipulating data in more complex ways it’s becoming more important to optimise our database queries to be as efficient as possible. I’m not going to cover caching in this article, instead I’m going to cover a more fundamental rule that should be followed when querying any database and follows this Python rule:

“Explicit is better than implicit.”

Lets start by looking at MySQL query performance from the command line. Lets imagine we had a user table with the following fields:

CREATE TABLE `article_db`.`users` (
`id` INT( 6 ) UNSIGNED NOT NULL AUTO_INCREMENT PRIMARY KEY ,
`group_id` INT( 6 ) UNSIGNED NOT NULL ,
`username` VARCHAR( 30 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL ,
`email` VARCHAR( 100 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL ,
`password` VARCHAR( 36 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL ,
`created` DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
`updated` DATETIME NOT NULL DEFAULT '0000-00-00 00:00:00',
`active` TINYINT( 1 ) NOT NULL DEFAULT '0',
UNIQUE (
`username` ,
`email`
)
) ENGINE = MYISAM CHARACTER SET utf8 COLLATE utf8_general_ci;

Normally to retrieve data from this table you would execute a query like the following. please note that I am using a remote database to create some lag. If you use a local database on your development machine you will probably retrieve the data in 0 seconds.

mysql> SELECT * FROM users;
+----+----------+----------+-----------------------+----------------------------------+---------------------+---------------------+--------+
| id | group_id | username | email | password | created | updated | active |
+----+----------+----------+-----------------------+----------------------------------+---------------------+---------------------+--------+
| 1 | 1 | admin | admin@example.com | 21232f297a57a5a743894a0e4a801fc3 | 2010-04-11 23:08:51 | 2010-04-11 23:08:51 | 1 |
| 2 | 2 | USER | USER@example.com | ee11cbb19052e40b07aac0ca060c23ee | 2010-04-11 23:08:51 | 2010-04-11 23:08:51 | 1 |
| 3 | 3 | test | test@example.com | 098f6bcd4621d373cade4e832627b4f6 | 2010-04-11 23:13:50 | 2010-04-11 23:13:50 | 0 |
| 4 | 4 | temp | temp@example.com | 3d801aa532c1cec3ee82d87a99fdf63f | 2010-04-11 23:13:50 | 2010-04-11 23:13:50 | 1 |
| 5 | 2 | me | me@example.com | ab86a1e1ef70dff97959067b723c5c24 | 2010-04-11 23:15:50 | 2010-04-11 23:15:50 | 1 |
| 6 | 2 | you | you@example.com | 639bae9ac6b3e1a84cebb7b403297b79 | 2010-04-11 23:15:50 | 2010-04-11 23:15:50 | 0 |
| 7 | 1 | john | john@example.com | 527bd5b5d689e2c32ae974c6229ff785 | 2010-04-11 23:17:04 | 2010-04-11 23:17:04 | 1 |
| 8 | 1 | master | master@example.com | eb0a191797624dd3a48fa681d3061212 | 2010-04-11 23:17:04 | 2010-04-11 23:17:04 | 1 |
| 9 | 1 | theboss | theboss@testing.com | b248e08d5c23541514558eea059c08cf | 2010-04-11 23:23:43 | 2010-04-11 23:23:43 | 1 |
| 10 | 2 | susan | susan@localdomain.com | ac575e3eecf0fa410518c2d3a2e7209f | 2010-04-11 23:23:43 | 2010-04-11 23:23:43 | 1 |
+----+----------+----------+-----------------------+----------------------------------+---------------------+---------------------+--------+
10 ROWS IN SET (0.05 sec)

In the previous query we used the wild-card selector ‘*’ to return all columns from the ‘users’ table. This in turn queried the database and returned the results as above. What I’m going to do next is query the database for the same data but this time I’m going to name the fields that I require in my returned dataset:

mysql> SELECT id,group_id,username,email,password,created,updated,active FROM users;

+----+----------+----------+-----------------------+----------------------------------+---------------------+---------------------+--------+

| id | group_id | username | email | password | created | updated | active |

+----+----------+----------+-----------------------+----------------------------------+---------------------+---------------------+--------+

| 1 | 1 | admin | admin@example.com | 21232f297a57a5a743894a0e4a801fc3 | 2010-04-11 23:08:51 | 2010-04-11 23:08:51 | 1 |

| 2 | 2 | USER | USER@example.com | ee11cbb19052e40b07aac0ca060c23ee | 2010-04-11 23:08:51 | 2010-04-11 23:08:51 | 1 |

| 3 | 3 | test | test@example.com | 098f6bcd4621d373cade4e832627b4f6 | 2010-04-11 23:13:50 | 2010-04-11 23:13:50 | 0 |

| 4 | 4 | temp | temp@example.com | 3d801aa532c1cec3ee82d87a99fdf63f | 2010-04-11 23:13:50 | 2010-04-11 23:13:50 | 1 |

| 5 | 2 | me | me@example.com | ab86a1e1ef70dff97959067b723c5c24 | 2010-04-11 23:15:50 | 2010-04-11 23:15:50 | 1 |

| 6 | 2 | you | you@example.com | 639bae9ac6b3e1a84cebb7b403297b79 | 2010-04-11 23:15:50 | 2010-04-11 23:15:50 | 0 |

| 7 | 1 | john | john@example.com | 527bd5b5d689e2c32ae974c6229ff785 | 2010-04-11 23:17:04 | 2010-04-11 23:17:04 | 1 |

| 8 | 1 | master | master@example.com | eb0a191797624dd3a48fa681d3061212 | 2010-04-11 23:17:04 | 2010-04-11 23:17:04 | 1 |

| 9 | 1 | theboss | theboss@testing.com | b248e08d5c23541514558eea059c08cf | 2010-04-11 23:23:43 | 2010-04-11 23:23:43 | 1 |

| 10 | 2 | susan | susan@localdomain.com | ac575e3eecf0fa410518c2d3a2e7209f | 2010-04-11 23:23:43 | 2010-04-11 23:23:43 | 1 |

+----+----------+----------+-----------------------+----------------------------------+---------------------+---------------------+--------+

10 ROWS IN SET (0.01 sec)

As you can see, by defining a more explicit query you have reduced the execution time from 0.05 to 0.01 seconds. This may not be too impressive, but imagine the “now” common application queries a database. During the life cycle of a page execution in a content management system you could be looking at around 10 – 40 (this is just an example figure) database queries being executed during this time. In turn each of these queries take .05 seconds to execute (40 * .05) = 2 seconds. So you go through your application and modify it to select one the columns you need. If we take the examples above we would have (40 * .01) = .4, that’s a massive 1.6 (thanks ekozan) seconds faster!

Hope this helps!