Rack-webconsole: a Ruby/Rails console inside your browser

http://blog.codegram.com/2011/7/rack-webconsole-a-rubyrails-console-inside-your-browser

by rohitarondekar • 15 years ago

104 55 15 years ago

blog.codegram.com

patio115• 15 years ago

This is a very bad idea.

txus4• 15 years ago

It is meant for development environments only. Nobody would risk putting a Ruby console in production :)

In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.

patio115• 15 years ago

I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard.

Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.

ianpurton• 15 years ago

I think you can achieve the same thing using shellinabox. Take a look at http://blog.servermonitoringhq.com/posts/the_ultimate_web_ba...

SingAlong2• 15 years ago

Right! A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk, unless you are paranoid about securing your iron cage.

If anyone has used the Seaside framework, can you throw some light on how this compares to the in-page editing that Seaside provides (as per what I've heard).

sabat5• 15 years ago

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development, this is invaluable and awesome.

tptacek9• 15 years ago

He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment".

At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later.

At worst, you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN. Now you're a cute cat picture away from attackers with direct TCP access to your database servers. Wee!

patio115• 15 years ago

Sabat, would you do the following for me?

Turn on Rails.

Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter.

Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings.

Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you were looking at. Any element would do. Say, you come to a blog where I control an image embed for my avatar, and I embed <img src="http://localhost:3000/a-malicious-string />. Firefox is going to make the HTTP request I desire without you having to do anything suspicious and without me having to ever talk to localhost:3000 directly.

After I have a malicious string in your web server, this application lets me execute arbitrary code as your web server. Things get very, very interesting then, in the "may you live in interesting times" sense of interesting. For example, one interesting thing I could do is read your SSH private key, which you use to connect from development to staging or production. Another thing I could do is read your database credentials from database.yml, and maybe even just open up extra ActiveRecord connections directly to those databases and start executing arbitrary SQL. Still another thing I could do is install a keylogger or rootkit on your local machine and wait to get whatever credential I need to totally compromise your company. There are many, many options.

Do not install this anywhere.

ojilles2• 15 years ago

As patio11 already noted, this is a bad idea. Further more, I don't see what it solves? Can't you just ssh into the box, and have that window open? Isn't this a window manager problem rather than a "rake/infrastructure" problem?

jrom• 15 years ago

I think this is a pretty cool tool, for both development/staging and also for production in a very restricted way. Every site has some kind of admin panel. I see this like a phpMyAdmin on asteroids for rack apps.

Definitely interesting.

sabat5• 15 years ago

Except for extreme circumstances (emergency debugging) I wouldn't let this thing near production. For development, it's super-handy, though.

mtogo2• 15 years ago

I see this like a phpMyAdmin on asteroids for rack apps.

Dear christ, please do not ever put this near production.

aaronbrethorst• 15 years ago

phpMyAdmin on asteroids sounds about right. http://en.wikipedia.org/wiki/Cretaceous%E2%80%93Tertiary_ext...

mef• 15 years ago

Reading the headline, I was hoping this was a ruby-debug console in the localhost browser for the current request. Perhaps that can be shoehorned into rack-webconsole?

cldwalker• 15 years ago

You'd probably be interested in https://github.com/ryanb/enlighten

masylum• 15 years ago

Cool! Firebug for the frontend, rack-webconsole for the backend.

damoncali• 15 years ago

Nice way to introduce Rack. Much better than the usual hello world.

I wouldn't use it for obvious reasons, but I like the demo.

hemancuso• 15 years ago

This seems like a boon for anyone trying to develop and debug issues on Heroku

ghayes• 15 years ago

It's sweet to see internet browsers opening up for development within themselves. We can surely do this securely with some amount of effort. I'd love to see a world without the need for Eclipse / Aptana.

txus4• 15 years ago

On the CSRF concern, which is totally valid, I've pushed a patch. From version 0.0.5 it uses a token to prevent this kind of attacks.

https://github.com/codegram/rack-webconsole/commit/d5060d0e8...

Rack-webconsole: a Ruby/Rails console inside your browser

Related Stories