Hulihan Applications Blog

Strip HTML in Ruby on Rails

Sat, 19 Jul 2008 22:59:00 -0600

Code Security is very important nowadays, so I thought I'd show everyone how to automatically strip off any HTML, javascript, css, etc. tags in ruby on rails. Many malicious users often try to type in code that execute when another person is looking at what they typed(like a forum post, for instance). Some security issues caused by this are XSS(Cross Site Scripting) and CSRF(Cross Site Request Forgery). So if someone is going to enter in ANY text that will show up on your site, I'd recommend that you clean their text of code before it's entered into your website/software.

Here's how to clean a normal string:

string = "<b>Bob</b>"

string = string.gsub(/<\/?[^>]*>/, "")

Also, another handy thing you can do is clean everything going into
your database. This code will automatically clean any string or text
data in your database. You don't even have to enter in the name of
the columns you want cleaned. All you have to do is change the name of the model(it's in orange below) and then enter in the code into your class model, ie: product.rb. And it will take care of the cleaning
for you:

class Product < ActiveRecord::Base

before_save :strip_html
def strip_html # Automatically strips any tags from any string to text typed column
    for column in Product.content_columns
      if column.type == :string || column.type == :text # if the column is text-typed
        if !self[column.name].nil? # strip html from string if it's not empty
          self[column.name] = self[column.name].gsub(/<\/?[^>]*>/, "")
        end
      end
    end
end

Keep in mind that this code will clean out ANYTHING that is in tags,
such as: <br><b><whatever><cheese><etc>

Amethyst 0.1.4 Released

Sat, 17 May 2008 00:06:00 -0600

Hey Everyone! Just a quick note, Amethyst 0.1.4 was released tonight. We fixed some issues with the RSS feed, and also added a CAPTCHA capability to prevent spammers from adding annoying comments. As always, you can try it out in the Amethyst Demo. Enjoy!

Filtering out Swear words in Ruby

Tue, 01 Apr 2008 18:17:00 -0600

I was looking around for a quick couple of lines of code that would search out any string for a swear word and replace it with a cleaner word. I had a little trouble finding an easy example, so here's one for you. I use a modified version of this script for a lot of my applications:

$ nano filter_swear_words.rb

#!/usr/bin/ruby
@string = "What the funk"

@bad_words = Hash.new
@bad_words[:funk] = "funny" #the [:funk] is the bad word, and the "funny" is the replacement@bad_words[:shoot] = "shucks" # add more in this fashion

@seperated_words = @string.split(" ") # seperate content by spaces

print "Original String: #{@string}\n"

@cleaned_string = ""

for word in @seperated_words
@bad_words.each do |bad_word, replacement|
if word == bad_word.to_s # if the word we're looking at is bad

word = replacement # replcae the word

else # the word is we're looking at is okay
end
end

@cleaned_string << word + " "
end

print "Cleaned String: #{@cleaned_string}\n"

So when we run the script, here's what we get:

$ ruby filter_swear_words.rb

Original String: What the funk
Cleaned String: What the funny

Downgrading Ruby on Rails

Sun, 02 Mar 2008 21:40:00 -0700

Well, now that the new version of ruby on rails is out(2.0.2), everything should be new and improved. I do like a lot of things in the new version of rails but many of my apps are written in previous versions(like 1.2.6) and I'd like to keep them that way, for now. Rails 2.x is pretty good, but it's missing a lot of old rails core commands(like the old rest-less script/generate scaffold), that I happen to use sometimes. Also, a lot of people deploy rails applications in shared hosting environments and other places where they don't have the permissions to reinstall old versions of rails via gem, so here's an alternative. Here we will actually freeze the older version of rails to our application. In this example, I'll be downgrading ruby on rails 2.0.2 to 1.2.6.

First, create a new rails application(we'll call it app):

$ rails app

Then, cd into the directory:

$ cd app

Now we will download the version of rails you want(here we will grab 1.2.6, but you can get any version) from the rails archive:

Note: you can do this a couple of different ways, this is using svn

$ svn co http://dev.rubyonrails.org/svn/rails/tags/rel_1-2-6/

Copy and rename the downloaded folder to vendor/rails:

$ mv rel_1-2-6/ vendor/rails

Note: Rails looks automatically for a vendor/rails folder before using the server-wide ruby on rails libraries(aka gems). Having them stored this way is called "freezing" your gems.

Now all we have to do is replace the 2.0.2 version of config/environment.rb file with a copy of the 1.2.6 version:

$ mv config/environment.rb config/environment.rb.original

$ nano -w config/environment.rb

Here I'm using the linux text editor, nano. You can also use emacs, vi, notepad, textpad, or whatever you want. Basically, we're going to create a new empty file named config/environment.rb and paste this code into it:

ENV['RAILS_ENV'] ||= 'development'
RAILS_GEM_VERSION = '1.2.6'

require File.join(File.dirname(__FILE__), 'boot')
Rails::Initializer.run do |config|
config.action_controller.perform_caching = true
end

If you used the nano command(which I am using in this example), you can save the file by pressing CTRL + O(hold down the ctrl key and hit O), and then CTRL + X.

That's it! You can now confirm that your using rails 1.2.6 by running this command:

$ script/about

You should see the version of rails now being 1.2.6, like so:

About your application's environment
Ruby version                     1.8.6 (x86_64-linux)
RubyGems version             1.0.1
Rails version                            1.2.6
Active Record version        1.15.6
Action Pack version             1.13.6
Action Web Service version 1.2.6
Action Mailer version           1.3.6
Active Support version       1.4.4
Edge Rails revision             8976
Application root                  /home/bob/app
Environment                      development
Database adapter              mysql

Amethyst released

Fri, 15 Feb 2008 14:34:00 -0700

It's that time again. We released another application this month! Today we released Amethyst to the public. It's a blogging application written in ruby on rails. It's very simple, clean, and straightforward. Keep in mind that it's our first release, so it's in beta(though we've tested it quite a bit, just like anything else we release). Our blog runs on amethyst, so check it out and see what you think. If you have any suggestions, let us know!

If you're interested in the Amethyst blog software, you can try out a demo or download it at the project page here:

http://www.hulihanapplications.com/projects_amethyst.php

Enjoy!

Onyx Released

Mon, 04 Feb 2008 22:33:00 -0700

Well, we finally released the first version of Onyx today, our Ruby on Rails gallery application. It's the very first version, and we've tested it quite a bit, and it seems to be very promising. Since it is brand new, it is still in beta. It has a couple of really cool features, url image grabbing and tag galleries, etc. Take a look, here's the link to the project page:

http://www.hulihanapplications.com/projects_onyx.php

Download it or try the demo, and let us know what you think!

Mysql Console Rake Task

Sat, 02 Feb 2008 13:37:00 -0700

I just wanted to share a handy rake task that I found. It allows you to connect directly to a mysql console in a linux shell(granted the 'mysql' command is present). It reads in the mysql connection settings stored in config/database.yml so there's no need to enter in a user/database name or password. Here's the code you can add to lib/tasks/mysql.rake (or whatever) or Rakefile

def mysql_console(config)
returning '' do |mysql|
    mysql << mysql_command << ' '
    mysql << "-u#{config['username']} " if config['username']
    mysql << "-p#{config['password']} " if config['password']
    mysql << "-h#{config['host']} "     if config['host']
    mysql << "-P#{config['port']} "     if config['port']
    mysql << config['database']         if config['database']
end
end

def mysql_command
'mysql'
end

desc "Launch mysql shell. Use with an environment task (e.g. rake production mysql)"
task :mysql do
system sh_mysql(YAML.load(open(File.join('config', 'database.yml')))[RAILS_ENV])
end

Then you would run the task by typing:

$ rake mysql

Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 109184 to server version: 5.0.45-community-log

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql>

That's it!

attr_accessor and ruby object variables

Fri, 21 Dec 2007 08:34:00 -0700

In most other languages(java, c++, etc.), when you create an object, you have to define the variables that will make up the structure of the object. You also usually add a getter(retrieves the variable) and a setter(sets/writes the contents of the variable) so you can access the variable.

However, in Ruby, you only need one line of code that will do all of the above:

attr_accessor :myvar

This creates the getter and setter methods from the variable, which(by default) look like this:

def myvar #this is the getter

@myvar #returns the contents of @myvar

end

def myvar(anything) #this is the setter

@myvar = anything #set the contents of myvar to anything!

end

You're also looking at the code to override the methods, too! Example: If you want to create a backup variable whenever you create the original, do this:

app/model/example.rb

Class Example

attr_accessor :myvar

def myvar=(anything) #this is the setter

@myvar_backup = @myvar #backup the original variable

@myvar = anything #set the contents of myvar to anything!

end

script/console

@myExample = Example.new
=> #<Example:0x2b50b2c3d560>
>> @myExample.inspect # see what the object has
=> "#<Example:0x2b50b2c3d560>"
>> @myExample.myvar = "hello!" # set the variable
=> "hello!"
>> @myExample.inspect # see what the object has now
=> "#<Example:0x2b50b2c3d560 @myvar_backup=\"hello!\", @myvar=\"hello!\">"

Also, if you just wanted the getter or setter only, you would use:

attr_reader :myvar or attr_writer :myvar

What is a reverse proxy?

Sat, 08 Dec 2007 08:04:00 -0700

In the web world, a reverse proxy is often used to balance traffic going to a site across several servers. Here is a snippet from the sans institute that explains a reverse proxy in simpler terms:

So what exactly is a Reverse Proxy?

First let's review what a forward proxy or proxy is and how it works. A forward proxy acts as a gateway for a client's browser, sending HTTP requests on the client's behalf to the Internet.

The proxy protects your inside network by hiding the actual client's IP address and using its own instead.

When an outside HTTP server receives the request, it sees the requestor's address as originating from the proxy server, not from the actual client.

A Reverse Proxy proxies on behalf of the backend HTTP server, not on behalf of the outside client's request, hence the term "reverse".

Read more about this at: http://www.sans.org/reading_room/whitepapers/webservers/302.php

First Post

Fri, 07 Dec 2007 11:31:00 -0700

Welcome to our blog! This purpose of this blog is to provide the public with cool information regarding networking, web design & development, ruby on rails, etc. etc. Hope you enjoy!