Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Rack-webconsole: a Ruby/Rails console inside your browser

blog.codegram.com

Post reply on HN
Print view View original

31–40 of 57 posts

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#31

Post by SingAlong »

txus wrote: post #4
patio11 wrote: post #2

This is a very bad idea.

It is meant for development environments only. Nobody would risk putting a Ruby console in production :) In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.

Right! A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk, unless you are paranoid about securing your iron cage.

If anyone has used the Seaside framework, can you throw some light on how this compares to the in-page editing that Seaside provides (as per what I've heard).

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#32

Post by patio11 »

SingAlong wrote: post #31
txus wrote: post #4

Earlier quoted context omitted.

It is meant for development environments only. Nobody would risk putting a Ruby console in production :) In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.

Right! A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk, unless you are paranoid about securing your iron cage. If anyone has used the Seaside framework, can you throw some light on how this compares to the in-page editing that Seaside provides (as per what I've hear…

A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk

One of your friends is named Firefox, and he does not take orders from you, he takes orders from me.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#33

Post by patio11 »

sabat wrote: post #12
patio11 wrote: post #2

This is a very bad idea.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development , this is invaluable and awesome.

Sabat, would you do the following for me?

Turn on Rails.

Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter.

Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings.

Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you were looking at. Any element would do. Say, you come to a blog where I control an image embed for my avatar, and I embed http://localhost:3000/a-malicious-string />. Firefox is going to make the HTTP request I desire without you having to do anything suspicious and without me having to ever talk to localhost:3000 directly.

After I have a malicious string in your web server, this application lets me execute arbitrary code as your web server. Things get very, very interesting then, in the "may you live in interesting times" sense of interesting. For example, one interesting thing I could do is read your SSH private key, which you use to connect from development to staging or production. Another thing I could do is read your database credentials from database.yml, and maybe even just open up extra ActiveRecord connections directly to those databases and start executing arbitrary SQL. Still another thing I could do is install a keylogger or rootkit on your local machine and wait to get whatever credential I need to totally compromise your company. There are many, many options.

Do not install this anywhere.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#34

Post by ojilles »

sabat wrote: post #20
tptacek wrote: post #17

Earlier quoted context omitted.

He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…

after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94…

It doesn't need to be internet enabled, that's the point. As long as I can guess the URL you are using for your development machine and have you click on a link on your laptop one can make this work (in the bad sense of the word).

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#35

Post by ojilles »

patio11 wrote: post #2

This is a very bad idea.

As patio11 already noted, this is a bad idea. Further more, I don't see what it solves? Can't you just ssh into the box, and have that window open? Isn't this a window manager problem rather than a "rake/infrastructure" problem?

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#36

Post by bhousel »

tptacek wrote: post #17
sabat wrote: post #12

Earlier quoted context omitted.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development , this is invaluable and awesome.

He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…

I've read through the rest of this thread, and I'm still not understanding the big deal about this tool.

If the entire dev environment is my macbook, and the app is localhost:3000, and the line to enable this thing exists only in the development environment initializer, and I leave it commented out all the time except for those rare cases where I want to inspect session variables and controller state or some other thing that can't really be done in irb, then what's the risk?

At least, that's how I would use it...

EDIT: Nevermind, patio11 explained it much better in his response above. I still think this could be a useful tool with CSRF protection.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#38

Post by tptacek »

bhousel wrote: post #36
tptacek wrote: post #17

Earlier quoted context omitted.

He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one…

I've read through the rest of this thread, and I'm still not understanding the big deal about this tool. If the entire dev environment is my macbook, and the app is localhost:3000, and the line to enable this thing exists only in the development environment initializer, and I leave it commented out all the time except for those rare cases where I want to inspect session variables and controller state or some other th…

There used to be web-based Rails debuggers, didn't there? I haven't used any kind of Ruby debugger since 2007. I just keep an SSH screen with "bundle exec rails console" running. I'm of the impression that this is what most people do.

So what's the win here?

Even with CSRF protection, you still have to worry about who can talk to port 3000 on your machine. There's a "rails server" running on my Macbook pretty much every day. I bought a whole separate Macbook because I was worried about the attack surface that Rails runs with by default. Adding a remote shell to the mix doesn't seem like a win.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#39

Post by rufugee »

patio11 wrote: post #33
sabat wrote: post #12

Earlier quoted context omitted.

Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development , this is invaluable and awesome.

Sabat, would you do the following for me? Turn on Rails. Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter. Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings. Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you…

Help me understand this. In your example, how would this malicious string be any more worrisome with the console installed than without it? I realize you could trigger the console to be displayed by crafting a URL, but it would be displayed in my browser (and thus, localhost) as the consumer of your URL, correct? It'd be one thing if this gem caused any arbitrary query string to be executed as ruby code, but I don't believe it does. So help me understand the way you could exploit this?

I'm not doubting you...I'd simply like to understand. Thanks.

Re: Rack-webconsole: a Ruby/Rails console inside your browser

#40

Post by patio11 »

rufugee wrote: post #39
patio11 wrote: post #33

Earlier quoted context omitted.

Sabat, would you do the following for me? Turn on Rails. Open Firefox, type http://localhost:3000/a-malicious-string into the top bar. Hit enter. Observe how that gets you a malicious string to your web server. This particular string will 404. I can construct much more interesting strings. Now, notice that step where I told you a URL to type in? Pretend that, instead, I had control over some element of a webpage you…

Help me understand this. In your example, how would this malicious string be any more worrisome with the console installed than without it? I realize you could trigger the console to be displayed by crafting a URL, but it would be displayed in my browser (and thus, localhost) as the consumer of your URL, correct? It'd be one thing if this gem caused any arbitrary query string to be executed as ruby code, but I don't…

It'd be one thing if this gem caused any arbitrary query string to be executed as ruby code

That's pretty much the exact designed intent of the software. Read the Repl code, specifically, Repl#call at line 59 or so.

https://github.com/codegram/rack-webconsole/blob/master/lib/...

You'll note the code has recently been enhanced with check_legitimate, which was designed to patch the issue I raised on this thread (and via email). I am going to very carefully avoid commenting about whether check_legitimate actually works as designed. My main worry is that pronouncing it done well would make me professionally responsible when it gets cracked, and committing to endless rounds of "Actually, that won't really work" throws good hours after bad in pursuit of securing a bad idea which is architecturally insecurable.

Do not allow your web application to execute arbitrary code. It will not end well.

Post reply on HN