Skip to content

Instantly share code, notes, and snippets.

View joseph-ravenwolfe's full-sized avatar
🚀

Joseph Ravenwolfe joseph-ravenwolfe

🚀
View GitHub Profile
@joseph-ravenwolfe
joseph-ravenwolfe / action_view_header_caching_handler.rb
Created December 4, 2013 21:28
Rails DDOS Vulnerability Patch
# config/initializers/action_view_header_caching_handler.rb
ActiveSupport.on_load(:action_view) do
ActionView::LookupContext::DetailsKey.class_eval do
class << self
alias :old_get :get
def get(details)
if details[:formats]
details = details.dup
@joseph-ravenwolfe
joseph-ravenwolfe / html_safe_i18n_exception_handler.rb
Created December 4, 2013 21:15
Reflective i18n XSS Vulnerability Patch
# config/initializers/html_safe_i18n_exception_handler.rb
require 'i18n'
# Override exception handler to more carefully html-escape missing-key results.
class HtmlSafeI18nExceptionHandler
Missing = I18n.const_defined?(:MissingTranslation) ? I18n::MissingTranslation : I18n::MissingTranslationData
def initialize(original_exception_handler)
@original_exception_handler = original_exception_handler
# What we are going to do is retrieve all of the users.
#
# Then loop through all of the users. For each user that
# we loop through, we will get all of their clients.
#
# Then we will loop through each of that user's clients
# and send that client an email.
#
# We will send the client object into daily_email and
# let daily_mail get whatever information it needs
# Remove .sh from the filename
ZSH_THEME_GIT_PROMPT_PREFIX="%{$reset_color%}%{$fg[red]%}"
ZSH_THEME_GIT_PROMPT_SUFFIX="%{$reset_color%}"
ZSH_THEME_GIT_PROMPT_DIRTY="%{$fg[white]%}*%{$reset_color%}"
ZSH_THEME_GIT_PROMPT_CLEAN=""
# Customized git status, oh-my-zsh currently does not
# allow render dirty status before branch
git_custom_status() {
fontName = "Monaco"
fontSize = 19
tabSize = 2
softTabs = true
softWrap = false
exclude = "{$exclude,*.tmproj,*.log}"
excludeInFolderSearch = "{$excludeInFolderSearch,db/migrate,log,doc}"