Skip to content

Instantly share code, notes, and snippets.

@brenes
brenes / model_with_attributes.rb
Last active December 15, 2015 11:29
Common shared examples for rspec
shared_examples_for "model with attributes" do |model_name|
context "validations" do
context "with valid values" do
let(:attributes) { attributes_for model_name }
let(:model_object) { build model_name, attributes }
subject { model_object }
@brenes
brenes / Readme.md
Last active June 7, 2017 04:23
Rails <= 2.3 patch for CVE-2013-1854, CVE-2013-1855, CVE-2013-1856 and CVE-2013-1857 vulnerabilities

Rails <= 2.3 patch for CVE-2013-1854, CVE-2013-1855, CVE-2013-1856 and CVE-2013-1857 vulnerabilities

Extracted from official patchs.

  • Add files in '/config/initializers' directory.

Notes

  • CVE-2013-1854 patch had some compatibility issues with has_many_polymorphs as it overwrites the create_reflection method to include the has_many_polymorphs relation. It was solved by including the HMP code into our patch as it should only be executed when a HMP relation is declared.
@brenes
brenes / commit
Created February 11, 2013 16:19
Todo.txt addon to commit the added files on a git repo. It searches for a ticket number in the issue line (#TICKET_NUMBER) and opens the default editor with a commit message preloaded with the ticket number
#!/usr/bin/env bash
action=$1
shift
function usage(){
echo " Commits changes for the mentioned issue"
echo " commit ITEM#"
echo " Searches for an issue number in the todo line and opens the default editor with the issue number just to write your commit"
echo ""
@brenes
brenes / 1ST README
Last active December 11, 2015 21:39 — forked from rsierra/1ST README.md
Rails 2.3.5 version of the Rails 2.1.1 patch by @rsierra
Rails 2.3.5 patch for CVE-2013-0333 vulnerability:
If you can't upgrade your Rails installation you can get the OkJson parser and include it in your project. How?
- Add cve_2013_0333_patch.rb in '/config/initializers' directory.
- Add okjson.rb in '/lib/active_support/json/backends' directory.
To test the parser, try to decode with a bad formatted json:
(I don't know if it's the best test, but you check if you are using the json parser in the rails 2.3 official patch)
@brenes
brenes / ngingx_conf
Created January 18, 2013 12:33
Nginx Configuration to redirect development assets to production site (and not having to download all the assets)
location ~* ^/.+\.(jpe?g|gif|png|ico|zip|tgz|rar|bz2|doc|xls|exe|pdf|ppt|html?|tar|mid|midi|wav|bmp|rtf|swf|avi|mp3)$ {
expires 30d;
rewrite ^ http://www.example.com/$request_uri? permanent;
break;
}
@brenes
brenes / xml_parser.rb
Created January 15, 2013 22:08
Wukong XML Parser
# Based on http://thedatachef.blogspot.com/2011/01/processing-xml-records-with-hadoop-and.html although I only can find it through Google Cache:
# http://webcache.googleusercontent.com/search?q=cache:VuIRvlkYpjcJ:thedatachef.blogspot.com/2011/01/processing-xml-records-with-hadoop-and.html+&cd=1&hl=es&ct=clnk&gl=es
#!/usr/bin/env ruby
require 'rubygems'
require 'wukong'
require 'wukong/encoding'
require 'crack'
@brenes
brenes / model_extension.rb
Last active February 14, 2024 11:39
Removing validation of a model declared on a gem
# We have to remove validations on email, as it's no longer needed.
# Based on a solution found at http://stackoverflow.com/questions/7545938/how-to-remove-validation-using-instance-eval-clause-in-rails
Model.class_eval do
_validators.reject!{ |key, _| key == :field }
_validate_callbacks.each do |callback|
callback.raw_filter.attributes.delete :field
end
@brenes
brenes / Readme
Created January 9, 2013 12:20
CVE-2013-0156 quick patch for Rails 2.3 apps
This patch fixes vulnerability CVE-2013-0156 in ActionPack[1] and it's intended for those apps that can't be updated and must find a quick solution.
Just add the files to your project, require lib/patch/hash_conversions.rb, and that's all.
This code patches ActiveSupport::CoreExtensions::Hash::Conversions methods so it takes into account the disallowed types and is based on 2.3 patch[2]
[1] https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
[2] https://rubyonrails-security.googlegroups.com/attach/c1432d0f8c70e89d/2-3-xml_parsing.patch?gda=ulUUK0YAAABpGVv8GMoSBgW4J3Kez9oiOxgqxuyBYM9wRi8LhPWtIxxSeo4ig8fNU0gXvTeISk5x40jamwa1UURqDcgHarKEE-Ea7GxYMt0t6nY0uV5FIQ&pli=1&view=1&part=3
@brenes
brenes / sample.tex
Created December 18, 2012 16:07
Simple latex document template
\documentclass[12pt]{article}
\usepackage[utf8]{inputenc}
\usepackage[spanish,activeacute]{babel}
\title{Titulo}
\author{Autor}
\begin{document}
@brenes
brenes / app|decorators|models|refinery|page_decorator.rb
Created October 30, 2012 09:12
Decoration of Refinery::Page for getting rid of locale=XX bug on refinerycms_translate_routes
Refinery::Page.class_eval do
# When this page is rendered in the navigation, where should it link?
# If a custom "link_url" is set, it uses that otherwise it defaults to the nested path.
# This method is decorated so the ?locale=es doesn't appear at the end of the urls
def url
if link_url.present?
link_url_localised?
else
nested_path