Expose any Ruby object over the web. An interesting little snippet...

https://gist.github.com/675667

by steveklabnik • 16 years ago

88 25 16 years ago

gist.github.com

rauljara2• 16 years ago

Depending on your point of view, this is a perfect example of either what makes ruby so amazing or so awful. I don't know of another language that gives you the power to so concisely potentially screw yourself in such a creative way.

andreyf2• 16 years ago

Let's not be too eager to accept the "tradeoff metaphor".

Just because something is powerful doesn't mean it can't be safe. I just got a handheld vacuum that has no safety mechanisms: no latches to disable the power button when it's folded shut, no kill switches when I take it apart. I can fold over the nozzle, take off the dust holder, and turn it on. I would never need to operate it in that way (unless I was using it as an air pump, which I could, now that I think of it), but it doesn't need any complexity to be safe, because safety is part of its design.

Similarly, a VM could expose a REST-ful API to its objects without needing to have any of the things which people find "unsafe" about Ruby (regardless of how valid those complaints are).

cageface• 16 years ago

The problem with sharp edges in programming languages is that you might be perfectly sane and careful on your own but you must also trust everybody else you code with to not only exercise the same restraint but to also point their sharp edges in roughly the same direction.

rauljara2• 16 years ago

Don't get me wrong, I fall squarely on the side that Ruby's power is well worth it's danger. But let's not kid ourselves, monkey-patching Object is dangerous. In this example, exposing all of an object's methods to the web means that anyone could further modify whatever object you stuck up there, adding whatever methods they wanted. Yes, you could expose it to the web in a safe manner, but that would be a lot more work. Ruby holds out that simple, easy, even elegant monkey-patching solution to tempt you in ways that you have to be really careful about.

ErrantX• 16 years ago

uh, pretty much every other web able programming language will let you do exactly the same... php, python etc.

steveklabnik4• 16 years ago

The key phrases were 'concise' and 'creative'. Of course you can expose an object's methods in any language, but not many will let you do it by monkeypatching Object with a two-line method.

kingkilr2• 16 years ago

A Python version for the kids at home: https://gist.github.com/702001

riklomas• 16 years ago

And a node.js version too: https://gist.github.com/700995

devmon• 16 years ago

If you want to do this in node you should use something like http://github.com/marak/webservice.js instead.

It's the same principle but with more features, more development, and test coverage.

wwortiz• 16 years ago

I don't know much about python and webapps but what would you serve this with? I'm just curious as I don't see the equivalent serving in this as the node.js and ruby snippets.

Ixiaus• 16 years ago

A WSGI server (like paste, tornado, etc...) - you just wrap it in an app() function or object. It's very similar to Ruby's rack...

kingkilr2• 16 years ago

This can be run from the commandline with:

    gunicorn webapp

For example (if you have gunicorn installed).

ataylor284• 16 years ago

Here's a groovy version: https://gist.github.com/702337

draegtun• 16 years ago

And here are Perl (twice!) and Io versions for their dads :)

* https://gist.github.com/703620 - Perl using Plack

* https://gist.github.com/703651 - Perl using Continuity

* https://gist.github.com/703431 - Io using no external modules!

The Perl/Continuity is multiuser out of the box.

petercooper3• 16 years ago

Do not try this but off the top of my head, I think this vector could be slightly unnice: /send/exec/rm%20-rf%20%2F .. Will give it a go when I'm off the iPad :-)

Update: I forgot exec wants its input in a different format. /send/exec/date prints the date and stops the server so this vector is certainly potent. /send/exec/ls/-l/%2f does NOT do what I expect though as Rack seems to turn / back into %2f server side but /send/exec/ls/-l/. does what I'd expect.

Update 2: James Golick notes that calling ` works through send too and suggests using /`/. This has the benefit of returning the output of what was run like cat /etc/passwd, for example ;-)

steveklabnik4• 16 years ago

I don't think it'd actually work, since it sends all of the calls to an Array. Array doesn't respond_to exec.

petercooper3• 16 years ago

  [18:54:40 ~]$ irb
  >> [].send('exec', 'date')
  Tue Nov 16 18:54:48 GMT 2010

You can call Kernel's methods on any object (usually - there are some cases where not) through send, e.g. [].send(:puts, 10) .. I was working with Sven Fuchs on some "sandboxing" stuff a couple of years ago and we discovered this little doozy! (Though it's possible to figure out by noting that [].puts tells you private method `puts' called and send gets you around that problem.)

Typically you pass a symbol as the first argument but a string works too which, I believe, would make my attack vector work. Going to try it now.

Update: /send/exec/date works as expected (and stops the server).

Expose any Ruby object over the web. An interesting little snippet...

Related Stories