losingle losingle

Routes

小心地使用 Match（Rails 3 已实现）

Rails 3 提供了 match 方法供我们自定义 routes，然而我们要小心使用它以避免“跨站脚本攻击”（XSS Attack）。比如像这样的 routes：

注：（r3 代表 Rails 3，r4 代表 Rails 4）

# routes.rb

Rails has a handy truncate helper (which is actually mostly a method added to String ), but it warns you it's not safe to use on html source, it'll cut off end tags and such.

What if you want an HTML safe one? There are a variety of suggested solutions you can google, none of which were quite robust/powerful enough for me.

So I started with my favorite, by Andrea Singh, using nokogiri.

But:

I modified it to not monkey-patch Nokogiri, but be a static method instead (sadly making already confusing code yet more confusing, but I didn't want to monkey patch nokogiri)

	# -- encoding: utf-8 --
	require 'csv'
	require 'smsbao'

	class SendCsv < Smsbao
	def initialize(login, passwd)
	@smser = Smsbao.new(login, passwd)
	end

	def import(csv_file, col_sep=',') # MAC下为;

	# Run me with:
	#
	# $ nginx -p /path/to/this/file/ -c nginx.conf
	#
	# All requests are then routed to authenticated user's index, so
	#
	# GET http://user:password@localhost:8080/_search?q=*
	#
	# is rewritten to:
	#

	#!/usr/bin/env ruby
	require 'net/telnet'

	cache_dump_limit = 100
	localhost = Net::Telnet::new("Host" => "localhost", "Port" => 11211, "Timeout" => 3)
	slab_ids = []
	localhost.cmd("String" => "stats items", "Match" => /^END/) do \|c\|
	matches = c.scan(/STAT items:(\d+):/)
	slab_ids = matches.flatten.uniq
	end

	# If your workers are inactive for a long period of time, they'll lose
	# their MySQL connection.
	#
	# This hack ensures we re-connect whenever a connection is
	# lost. Because, really. why not?
	#
	# Stick this in RAILS_ROOT/config/initializers/connection_fix.rb (or somewhere similar)
	#
	# From:
	# http://coderrr.wordpress.com/2009/01/08/activerecord-threading-issues-and-resolutions/

	worker_processes 3 # amount of unicorn workers to spin up
	timeout 30 # restarts workers that hang for 30 seconds

	# fine tuning
	preload_app true
	GC.respond_to?(:copy_on_write_friendly=) and GC.copy_on_write_friendly = true

	before_exec do \|server\|
	ENV['RUBY_HEAP_MIN_SLOTS']=800000
	ENV['RUBY_GC_MALLOC_LIMIT']=59000000

	# foo.rb
	class Foo < ::Sinatra::Base

	class << self
	def dependencies; []; end
	def setup_application!; end
	end

	get '/' do
	'wubwub'

	require 'goliath'
	require 'em-synchrony/em-http'

	class UploadProxy < Goliath::API

	def on_headers(env, headers)
	env.logger.info 'received headers: ' + headers.inspect
	env['async-headers'] = headers
	end

	# see http://stackoverflow.com/questions/5880962/how-to-destroy-jobs-enqueued-by-resque-workers - old version
	# see https://github.com/defunkt/resque/issues/49
	# see http://redis.io/commands - new commands

	namespace :resque do
	desc "Clear pending tasks"
	task :clear => :environment do
	queues = Resque.queues
	queues.each do \|queue_name\|
	puts "Clearing #{queue_name}..."