jjb

For years, people have been using jemalloc with ruby. There were various benchmarks and discussions. Legend had it that Jemalloc 5 didn't work as well as Jemalloc 3.

Then, one day, hope appeared on the horizon. @wjordan offered a config for Jemalloc 5.

Ubuntu/Debian

FROM ruby:3.1.2-bullseye
RUN apt-get update ; \

amkisko

# AUTHOR: Andrei Makarov (github.com/amkisko)

class ApplicationViewRecord < ApplicationRecord
  self.abstract_class = true

  def self.attribute_names
    @attribute_names ||= attribute_types.keys
  end

  def self.load_schema!

motoyasu-saburi

TL;DR

• I found 1 browser, 1 language, and 15 vulnerabilities in { Web Framework, HTTP Client library, Email library / Web Service, etc }
• All the vulnerabilities I found were found from a single perspective (I investigated maybe 50-80 products).
• The RFC description of the problem (rather confusingly) describes the requirements for this problem, while the WHATWG > HTML Spec is well documented.
• The problem is clearly targeted at the Content-Disposition fields filename and filename*.
• This problem affects HTTP Request/Response/Email in different ways.
  • HTTP Request : request tampering (especially with file contents, tainting of other fields, etc.)
  • HTTP Response : Reflect File Download vulnerability

• Email : Attachment tampering (e.g., extension and filename tampering and potential file content tampering)

amkisko

<div data-controller="address-form">
  <%= simple_form_for(address, url: address_path(address)) do |f| %>            
    <%= f.text_field :address, "data-address-form-target" => "address" %>
    <%= f.hidden_field :address_lon, "data-address-form-target" => "addressLon" %>
    <%= f.hidden_field :address_lat, "data-address-form-target" => "addressLat" %>
    <div data-address-form-target="addressMapContainer" style="width: 500px; height: 500px; margin-left: -3.6rem;"></div>
    <%= f.button :submit %>
  <% end %>
</div>

amkisko

#!/usr/bin/env ruby

# USAGE:
# APOLLO_SCHEMA_KEY=service:... APOLLO_SCHEMA_NAME=Project-Name ./cleanup_apollo_schema_variants.rb

require "pry"
require "uri"
require "json"
require "net/http"

shawnmclean

import { env } from "process";
import * as Parser from "rss-parser";
import slufigy from "slugify";
import * as Contentful from "contentful-management";
import { htmlToText } from "html-to-text";

const client = Contentful.createClient({
  accessToken: env.ACCESS_TOKEN,
});

kaspth

# All these requires are just for running via `irb`, if using `bin/rails console` you probably just need the method.
require "active_support/all" # Got an inflector NoMethodError, so I'm just being lazy here.

require "action_dispatch"
require "action_dispatch/routing/route_set"
require "action_dispatch/routing/inspector"

require "action_controller" # For the ActionController::Parameters autoload, which any route helper uses.

# Console helper play around with the routing DSL and tweak an individual route you're building.

peteristhegreat

Back in January, I tried colima and hit a snag on getting onto AWS ECR boxes. It ends up it was probably an issue with not being able to use the existing credentials file and I could have fixed it...

Today (Aug 2022) I am giving it another college try.

brew upgrade colima
ls -l $(which docker)
brew install docker
ln -s /Applications/Docker.app/Contents/Resources/bin/docker /usr/local/bin/docker-desktop
brew link --overwrite docker

brew install docker-credential-helper

amkisko

# filepath: app/lib/sidekiq_running.rb
# source_url: https://github.com/eljojo/sidekiq-running
# usage: `include ActiveJobSidekiqRunning` to job class

module ActiveJobSidekiqRunning
  def self.included(base)
    base.extend ClassMethods
  end

  module ClassMethods

amkisko

# AUTHOR: Andrei Makarov (github.com/amkisko)

require "bundler/inline"

gemfile(true) do
  source "https://rubygems.org"

  gem "noko"
  gem "dotenv"
  gem "active_support"