rails

Bilingual

Arbitrary file read and remote code execution in Active Storage
2 months ago
- A Rails application using Active Storage with image variants may allow unauthenticated attackers to read arbitrary files, including secret_key_base and credentials, potentially leading to remote code execution.
- The vulnerability stems from libvips' unfuzzed operations not being disabled by Active Storage, allowing attackers to invoke them via crafted file uploads.
- Affected applications use libvips for image processing (config.active_storage.variant_processor = :vips) and allow image uploads from untrusted users.
- Mitigation requires upgrading activestorage to fixed versions, upgrading libvips to >= 8.13, and changing all exposed secrets such as secret_key_base and credentials.
- If libvips < 8.13, no workarounds exist besides removing libvips; for libvips >= 8.13, unfuzzed operations can be blocked via environment variable or Ruby code.
- Secrets must be fully replaced (not just rotated) as exfiltration may have already occurred; upgrading only prevents future exploitation.
How to Implement TOTP 2FA in Rails using ROTP
2 months ago
- - The post explains how to implement TOTP (Time-based One-Time Password) two-factor authentication (2FA) in a Rails app using the ROTP gem.
- - It starts by reviewing the existing API key authentication flow and then creates a new `second_factors` table and model with an encrypted OTP secret.
- - The implementation includes CRUD operations for managing second factors, with verification requiring a password or OTP depending on whether 2FA is already enabled.
- - The authentication flow is adjusted to require an OTP when a user has a second factor enabled, returning specific error codes like `OTP_REQUIRED` and `OTP_INVALID`.
- - A provisioning URI is generated for QR code scanning to set up TOTP in authenticator apps, and the second factor must be verified with a valid OTP before enabling.
- - The post addresses a vulnerability by adding an `otp_verified_at` column to prevent OTP reuse, ensuring tokens are one-time use only.
System tests
2 months ago
- The author argues that system tests are essential for ensuring the entire system works together, despite debates over terminology.
- Keygen's test suite takes over 2 hours on a single core, with most time spent on authorization and system tests.
- System tests are criticized for being slow and brittle, but the author believes they catch bugs that unit tests miss, especially in business logic within middleware and extensions.
- The author uses Gherkin and Cucumber for system tests, finding them effective for JSON APIs, though acknowledges they may be less suitable for HTML-rendered apps.
- System tests can be parallelized to reduce time; Keygen's tests run in ~10 minutes on 32 cores vs. 2 hours on one core.
- Without system tests, there is no guarantee that all components are correctly wired together, leaving potential bugs to be caught by customers.
How to Bulk Insert Nested Attributes in Rails
2 months ago
- Bulk inserting nested attributes in Rails can speed up large many-to-many inserts by reducing sequential SQL queries.
- The `autosave_associated_records_for_` method can be overridden to use `insert_all` for bulk inserts.
- Caveats include needing to handle validation, callbacks, and deletion of marked records manually.
- The approach uses an undocumented internal Rails method.
Move Fast and Break Things (Without Breaking Things)
2 months ago
- The author open-sourced a Ruby gem called request_migrations for versioning REST APIs, inspired by Stripe's approach, to fix past design mistakes in Keygen's distribution API.
- A major mistake was treating a release as a single artifact instead of a bucket of artifacts, causing challenges like inability to have multiple versions of the same artifact and complex draft-to-publish flows.
- The fix involved creating a real artifact model, moving attributes from release to artifact, and changing the relationship from has-one to has-many, which required extensive code changes but maintained backward compatibility.
- The request_migrations gem works by applying small, single-purpose migrations to transform request/response data between API versions, allowing the codebase to focus on the current version.
- The author emphasizes that breaking changes can be undone without scrapping everything, providing a way to improve API design over time.
How to Build a Webhook System in Rails Using Sidekiq
2 months ago
- A webhook system can be built in Rails using Sidekiq for async processing and retries.
- Define WebhookEndpoint and WebhookEvent models with subscriptions and enabled status.
- Create a WebhookWorker to deliver events via HTTP POST, handling errors like timeouts using pattern matching.
- Use BroadcastWebhookService to queue events for subscribed endpoints.
- Improve retry cadence with exponential backoff and jitter, limiting to 10 retries over ~3 days.
- Implement event subscription and endpoint disabling to reduce costs and improve performance.
- Use Ruby pattern matching for special-case handling, e.g., ngrok tunnel errors.
- Caveats include validating endpoints for TLS, avoiding loops, and handling response size.
Getting Rails' ActiveStorage blob IDs from file URLs
2 months ago
- Extract blob ID from expiring ActiveStorage URLs to avoid re-downloading images.
- The expiring URL contains a base64-encoded JSON object with a consistent blob ID.
- Method: split URL path by '/', take the third segment from the end, split by '--', decode base64, and read '_rails.data' from the JSON.
- Blob IDs are unique and not reused, allowing reliable file identification.
Questions for the Team During Onboarding
3 months ago
- A set of questions for developers, CTO/EM, and business stakeholders to audit a Rails codebase.
- Questions for developers focus on code fear, deployment timing, and production issues not caught by tests.
- Questions for CTO/EM cover feature blocks, error visibility, and underestimated feature timelines.
- Questions for business stakeholders address quietly disabled features and unfulfilled customer promises.
- Mentions recent articles related to sqlite-utils updates and agent video demo tools.
Avoiding SQLite Database Locks in Production
3 months ago
- The article discusses encountering SQLite3::BusyException in a Rails app using Solid Queue due to SQLite's single-writer locking mechanism.
- Key solutions include proper SQLite configuration with busy_timeout and timeout set to the same value, enabling WAL mode, and optimizing pragmas like synchronous and mmap_size.
- A misconfiguration in deploy.yml (SOLID_QUEUE_IN_PUMA env var) caused Solid Queue to run twice, leading to lock issues; fixing it resolved the problem.
- Recurring jobs in Solid Queue should be scheduled to avoid simultaneous execution to identify lock causes through logged exception times.
- Avoid using .find_each for batch updates in jobs as it holds a read cursor open; instead, pluck IDs and process in small batches to release locks quickly.
- An opencode skill was created to prevent SQLite lock issues by guiding AI agents to avoid read cursors during writes and batch writes in transactions.

rails

Arbitrary file read and remote code execution in Active Storage

How to Implement TOTP 2FA in Rails using ROTP

System tests

How to Bulk Insert Nested Attributes in Rails

Move Fast and Break Things (Without Breaking Things)

How to Build a Webhook System in Rails Using Sidekiq

Getting Rails' ActiveStorage blob IDs from file URLs

Questions for the Team During Onboarding

Avoiding SQLite Database Locks in Production