Bypassing GitHub's OAuth flow
What happens if we send an authenticated HEAD request to https://github.com/login/oauth/authorize? We’ve concluded that the router will treat it like a GET request, so it will get sent to the controller. But once it’s there, the controller will realize that it’s not a GET request, and so the request will be handled by the controller as if it was an authenticated POST request. As a result, GitHub will find the OAuth app specified in the request, and grant it access to the authenticated user’s data.
Help me, framework!
Benchmarking Fibers, Threads and Processes
Awhile back, I set out to look at Fiber performance and how it’s improved in recent Ruby versions. After all, concurrency is one of the three pillars of Ruby 3x3! Also, there have been some major speedups in Ruby’s Fiber class by Samuel Williams.
It’s not hard to write a microbenchmark for something like Fiber.yield. But it’s harder, and more interesting, to write a benchmark that’s useful and representative.
Weird Ruby: Positive and Negative Strings
Turns out that when frozen string literals were introduced in Ruby 2.3 a couple of unary methods were added to the String class - namely unary + and -. They made it possible to have “positive” and “negative” string literals. What does this mean exactly? Let’s figure this out together!
Ruby 2.7 — Numbered Parameters
Ruby 2.7 is coming out this December, as with all modern releases, but that doesn’t stop us from looking for and writing about all the fun things we find in the mean time! No no no. For this article, we have something that’s very reminiscent of Bash, Perl, and Scala: Numbered parameters.
Analysis for CVE-2019-5418 File Content Disclosure on Rails
What causes Ruby memory bloat?
If only there is a way visualize the OS heaps so that I can see what’s going. Unfortunately there are no tools that allow me to do that. So I wrote an OS heap visualizer myself.
Ruby 2.6.0 Released
It introduces a number of new features and performance improvements, most notably:
A new JIT compiler.
The RubyVM::AbstractSyntaxTree module.
The JIT compiler aims to improve the performance of Ruby programs. Unlike traditional JIT compilers which operate in-process, Ruby’s JIT compiler writes out C code to disk and spawns a common C compiler to generate native code. For more details about it, see the MJIT organization by Vladimir Makarov.
Ruby 2.6 introduces the RubyVM::AbstractSyntaxTree module. Future compatibility of this module is not guaranteed. This module has a parse method, which parses the given string as Ruby code and returns the AST (Abstract Syntax Tree) nodes of the code. The parse_file method opens and parses the given file as Ruby code and returns AST nodes.
Ruby 2.x Universal RCE Deserialization Gadget Chain
This blog post details exploitation of arbitrary deserialization for the Ruby programming language and releases the first public universal gadget chain to achieve arbitrary command execution for Ruby 2.x. This will be described in the following sections which detail deserialization issues and related work, discovery of usable gadget chains, and finally exploitation of ruby serialization.
Summer School With The Rust Compiler
Not sure if I learned more about rust or ruby here.
Rust is telling me that iter() yielded references to integers, but my code expected an actual integer, not a reference to an integer.
Now the array was mutated! It turns out Ruby passed integers to the closure by value, but strings by reference. Updating each string inside the loop also updated that string inside the array.
I managed to be surprised by both those statements.
Spying on a Ruby process's memory allocations with eBPF
My idea at the beginning of the day was – what if you could take an arbitrary Ruby process’s PID (that was already running!) and start tracking its memory allocations?
Reducing Memory Usage in Ruby
I’ve been working on building a compacting garbage collector in Ruby for a while now, and one of the biggest hurdles for implementing a compacting GC is updating references. For example, if Object A points to Object B, but the compacting GC moves Object B, how do we make sure that Object A points to the new location?
Malloc Can Double Multi-threaded Ruby Program Memory Usage
The problem manifests itself as a slow, creeping memory growth in Ruby processes. It is often mistaken for a memory leak. However, unlike a memory leak, memory growth due to fragmentation is logarithmic, while memory leaks are linear.
This starts off with a simpe problem and fix, but lots of info about what’s happening.
Memory Conscious Programming in Ruby
When programming in Ruby many people think that egregious memory usage is the norm and unavoidable. However, there are ways and strategies to keep memory usage down and in this post I will show you some of them.
Most modern programming languages have a function somewhere in their standard library for splitting strings.
What should it return?
Diploid and Crystal
At Diploid, we have been using Crystal for quite some time now. We would like to share our experience in this interview, answering questions relevant to companies wanting to use Crystal for production.
Why Ruby app servers break on macOS High Sierra and what can be done about it
Remote Code Execution on rubygems.org
I was surprised to learn that parsing untrusted YAML is dangerous. I had always figured it was a benign interchange format like JSON. In fact, YAML allows for the encoding of arbitrary objects, much like python’s pickle.
Strange Hash Instances in Ruby
Everything can be patched, except the things that cant.
Accidentally Quadratic: Ruby `reject!`
I find this interesting as a cautionary tale of how several of Ruby’s features (here, ubiquitous mutability, blocks, and nonlocal exits) interact to create suprising edge cases that need to be addressed, and how addressing those edge cases can easily result in yet more problems
Profiling MRuby Code
Back to mruby, the initial timer based profiling doesn’t have many of the advantages of callgrind, or other profiler tools. Adding timers was a manual process, it provided very coarse information, and it provided only a limited slice of the whole program. As such, a full mruby VM profiler should be preferred. The mruby-profiler gem is one such tool.