Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      The AI productivity paradox in software engineering: Balancing efficiency and human skill retention

      July 2, 2025

      The impact of gray work on software development

      July 2, 2025

      CSS Intelligence: Speculating On The Future Of A Smarter Language

      July 2, 2025

      Hallucinated code, real threat: How slopsquatting targets AI-assisted development

      July 1, 2025

      Xbox is cancelling Rare’s ‘Everwild’ and ZeniMax’s new MMORPG IP as part of broader cuts — with ‘Perfect Dark’ impacted as well

      July 2, 2025

      Microsoft is closing down Xbox studio The Initiative, with Perfect Dark killed as well — joining Everwild and ZeniMax’s new IP, and other unannounced projects

      July 2, 2025

      No, Microsoft and Xbox’s Phil Spencer isn’t stepping down any time soon — here’s the truth

      July 2, 2025

      Everwild’s cancellation has me worried for one of my favorite dev teams and Xbox itself — It needs creative new games to thrive and refresh its identity

      July 2, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      Trust but Verify: The Curious Case of AI Hallucinations

      July 2, 2025
      Recent

      Trust but Verify: The Curious Case of AI Hallucinations

      July 2, 2025

      From Flow to Fabric: Connecting Power Automate to Microsoft Fabric

      July 2, 2025

      Flutter Web Hot Reload Has Landed – No More Refreshes!

      July 2, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      Xbox is cancelling Rare’s ‘Everwild’ and ZeniMax’s new MMORPG IP as part of broader cuts — with ‘Perfect Dark’ impacted as well

      July 2, 2025
      Recent

      Xbox is cancelling Rare’s ‘Everwild’ and ZeniMax’s new MMORPG IP as part of broader cuts — with ‘Perfect Dark’ impacted as well

      July 2, 2025

      Microsoft is closing down Xbox studio The Initiative, with Perfect Dark killed as well — joining Everwild and ZeniMax’s new IP, and other unannounced projects

      July 2, 2025

      No, Microsoft and Xbox’s Phil Spencer isn’t stepping down any time soon — here’s the truth

      July 2, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»News & Updates»CodeSOD: A Ruby Encrusted Footgun

    CodeSOD: A Ruby Encrusted Footgun

    April 1, 2025

    Many years ago, JP joined a Ruby project. This was in the heyday of Ruby, when every startup on Earth was using it, and if you weren’t building your app on Rails, were you even building an app?

    Now, Ruby offers a lot of flexibility. One might argue that it offers too much flexibility, especially insofar as it permits “monkey patching”: you can always add new methods to an existing class, if you want. Regardless of the technical details, JP and the team saw that massive flexibility and said, “Yes, we should use that. All of it!”

    As these stories usually go, that was fine- for awhile. Then one day, a test started failing because a class name wasn’t defined. That was already odd, but what was even odder is that when they searched through the code, that class name wasn’t actually used anywhere. So yes, there was definitely no class with that name, but also, there was no line of code that was trying to instantiate that class. So where was the problem?

    def controller_class(name)
      "#{settings.app_name.camelize}::Controllers".constantize.const_get("#{name.to_s.camelize}")
    end
    
    def model_class(name)
      "#{settings.app_name.camelize}".constantize.const_get("#{name.to_s.camelize}")
    end
    
    def resource_class(name)
      "#{settings.app_name.camelize}Client".constantize.const_get("#{name.to_s.camelize}")
    end
    

    It happened because they were dynamically constructing the class names from a settings field. And not just in this handful of lines- this pattern occurred all over the codebase. There were other places where it referenced a different settings field, and they just hadn’t encountered the bug yet, but knew that it was only a matter of time before changing a settings file was going to break more functionality in the application.

    They wisely rewrote these sections to not reference the settings, and dubbed the pattern the “Caramelize Pattern”. They added that to their coding standards as a thing to avoid, and learned a valuable lesson about how languages provide footguns.

    Since today’s April Fool’s Day, consider the prank the fact that everyone learned their lesson and corrected their mistakes. I suppose that has to happen at least sometimes.

    [Advertisement]
    Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

    Source: Read More 

    Facebook Twitter Reddit Email Copy Link
    Previous ArticleLearning Through Play – CulinarySchools.org’s Educational Games
    Next Article ArchiveKeep keeps your files archived in multiple places

    Related Posts

    News & Updates

    Xbox is cancelling Rare’s ‘Everwild’ and ZeniMax’s new MMORPG IP as part of broader cuts — with ‘Perfect Dark’ impacted as well

    July 2, 2025
    News & Updates

    Microsoft is closing down Xbox studio The Initiative, with Perfect Dark killed as well — joining Everwild and ZeniMax’s new IP, and other unannounced projects

    July 2, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    Will you be the boss of your own AI workforce?

    Artificial Intelligence

    CVE-2024-54188 – Infoblox NETMRI File Disclosure

    Common Vulnerabilities and Exposures (CVEs)

    Empowering Small Businesses: How No-Code AI Tools Drive Scalable Growth🚀

    Web Development

    CVE-2014-6274 – Git-Annex AWS S3 and Glacier Unencrypted Credentials Storage Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    Highlights

    CVE-2025-52896 – Frappe Cross-Site Scripting (XSS) via Data Import Vulnerability

    June 30, 2025

    CVE ID : CVE-2025-52896

    Published : June 30, 2025, 5:15 p.m. | 26 minutes ago

    Description : Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading.

    Severity: 0.0 | NA

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    DB Browser for SQLite – create, design, and edit database files

    April 14, 2025

    Set Laravel User Locale in Middleware

    June 17, 2025

    Apple Backports Critical Fixes for 3 Recent 0-Days Impacting Older iOS and macOS Devices

    April 1, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.