Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      10 Ways Node.js Development Boosts AI & Real-Time Data (2025-2026 Edition)

      August 18, 2025

      Looking to Outsource React.js Development? Here’s What Top Agencies Are Doing Right

      August 18, 2025

      Beyond The Hype: What AI Can Really Do For Product Design

      August 18, 2025

      BrowserStack launches Chrome extension that bundles 10+ manual web testing tools

      August 18, 2025

      How much RAM does your Linux PC really need in 2025?

      August 19, 2025

      Have solar at home? Supercharge that investment with this other crucial component

      August 19, 2025

      I replaced my MacBook charger with this compact wall unit – and wish I’d done it sooner

      August 19, 2025

      5 reasons to switch to an immutable Linux distro today – and which to try first

      August 19, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      Sentry Adds Logs Support for Laravel Apps

      August 19, 2025
      Recent

      Sentry Adds Logs Support for Laravel Apps

      August 19, 2025

      Efficient Context Management with Laravel’s Remember Functions

      August 19, 2025

      Laravel Devtoolbox: Your Swiss Army Knife Artisan CLI

      August 19, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      From plateau predictions to buggy rollouts — Bill Gates’ GPT-5 skepticism looks strangely accurate

      August 18, 2025
      Recent

      From plateau predictions to buggy rollouts — Bill Gates’ GPT-5 skepticism looks strangely accurate

      August 18, 2025

      We gave OpenAI’s open-source AI a kid’s test — here’s what happened

      August 18, 2025

      With GTA 6, next-gen exclusives, and a console comeback on the horizon, Xbox risks sitting on the sidelines — here’s why

      August 18, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»News & Updates»CodeSOD: A Ruby Encrusted Footgun

    CodeSOD: A Ruby Encrusted Footgun

    April 1, 2025

    Many years ago, JP joined a Ruby project. This was in the heyday of Ruby, when every startup on Earth was using it, and if you weren’t building your app on Rails, were you even building an app?

    Now, Ruby offers a lot of flexibility. One might argue that it offers too much flexibility, especially insofar as it permits “monkey patching”: you can always add new methods to an existing class, if you want. Regardless of the technical details, JP and the team saw that massive flexibility and said, “Yes, we should use that. All of it!”

    As these stories usually go, that was fine- for awhile. Then one day, a test started failing because a class name wasn’t defined. That was already odd, but what was even odder is that when they searched through the code, that class name wasn’t actually used anywhere. So yes, there was definitely no class with that name, but also, there was no line of code that was trying to instantiate that class. So where was the problem?

    def controller_class(name)
      "#{settings.app_name.camelize}::Controllers".constantize.const_get("#{name.to_s.camelize}")
    end
    
    def model_class(name)
      "#{settings.app_name.camelize}".constantize.const_get("#{name.to_s.camelize}")
    end
    
    def resource_class(name)
      "#{settings.app_name.camelize}Client".constantize.const_get("#{name.to_s.camelize}")
    end
    

    It happened because they were dynamically constructing the class names from a settings field. And not just in this handful of lines- this pattern occurred all over the codebase. There were other places where it referenced a different settings field, and they just hadn’t encountered the bug yet, but knew that it was only a matter of time before changing a settings file was going to break more functionality in the application.

    They wisely rewrote these sections to not reference the settings, and dubbed the pattern the “Caramelize Pattern”. They added that to their coding standards as a thing to avoid, and learned a valuable lesson about how languages provide footguns.

    Since today’s April Fool’s Day, consider the prank the fact that everyone learned their lesson and corrected their mistakes. I suppose that has to happen at least sometimes.

    [Advertisement]
    Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

    Source: Read More 

    Facebook Twitter Reddit Email Copy Link
    Next Article ArchiveKeep keeps your files archived in multiple places

    Related Posts

    News & Updates

    How much RAM does your Linux PC really need in 2025?

    August 19, 2025
    News & Updates

    Have solar at home? Supercharge that investment with this other crucial component

    August 19, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    CVE-2025-48064 – GitHub Desktop Windows Network Share Path Traversal Information Disclosure

    Common Vulnerabilities and Exposures (CVEs)

    RansomHub Went Dark April 1; Affiliates Fled to Qilin, DragonForce Claimed Control

    Development

    CVE-2025-49452 – PostaPanduri SQL Injection

    Common Vulnerabilities and Exposures (CVEs)

    CVE-2025-7423 – Tenda O3V2 Stack-Based Buffer Overflow Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    Highlights

    CVE-2024-51107 – PHPGURUKUL Medical Card Generation System Stored XSS Vulnerability

    May 23, 2025

    CVE ID : CVE-2024-51107

    Published : May 23, 2025, 3:15 p.m. | 25 minutes ago

    Description : Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle, pagedes, and email parameters.

    Severity: 0.0 | NA

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    CVE-2025-1056 – Axis Camera Station Pro File Path Traversal Vulnerability

    April 23, 2025

    CVE-2025-49747 – Azure Machine Learning Privilege Escalation

    July 18, 2025

    What IP – get your IP easily

    May 10, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.