8 ms·

Rack-webconsole: a Ruby/Rails console inside your browser

104 points by rohitarondekar 15y ago

patio11 15y ago
This is a very bad idea.
- deleted 15y ago
  [deleted]
- txus 15y ago
  It is meant for development environments only. Nobody would risk putting a Ruby console in production :) In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.
  - patio11 15y ago
    I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard. Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.
    - nicholaides 15y ago
      Can you expand on this? What's the risk? What's the attack vector?
      - ciupicri 15y ago
        I think he's saying that someone can make you open a web page that includes an image with the proper src attribute and bang, your Rails site is broken.
        tptacek 15y ago
        More likely, your whole data center.
        sabat 15y ago
        Hyperbolic.
        tptacek 15y ago
        I know you've been a dev/ops guy for 20 years and I respect the fact that your development machines are sealed in vaults, but I've gotten to assess more than half of the top 10 biggest Rails apps in the world over the past couple of years and trust me, you're just wrong about this. Development machines are within reach of developer browsers. Database machines are within reach of development machines.
        ssmoot 15y ago
        You've probably figured this out by now, but I'm pretty sure you're missing the point. From your other comments in this thread you appear to think that the machine needs to be internet-accessible. Have a public IP. Open Firewall. All that. The reason this is so dangerous is that it needs none of that. All it needs is for your development machine to have access to the internet. I open up a project, enable this, and run rackup locally. I then view your Twitter stream, where you've embedded a crafted link behind a URL shortener. Because that link is executed by me, you've now remotely executed code on my machine. Assuming I'm anything like most Rails shops you can probably get to a number of other machines through my machine.
      - tptacek 15y ago
        Cross-site request forgery. I should add though that even if this thing gets an XSRF token and it's secure, you might as well take the passwords off your SSH keys if you're running this, because you're coughing up an unprotected remote shell to anyone who can talk to a dev server once you turn this on.
      - irahul 15y ago
        > What's the attack vector? CSRF.
    - txus 15y ago
      You're right, that's a risk. I've opened an issue to implement a simple pseudorandom token to protect AJAX requests. What do you think? https://github.com/codegram/rack-webconsole/issues/4 https://github.com/codegram/rack-webconsole/issues/4
  - ianpurton 15y ago
    I think you can achieve the same thing using shellinabox. Take a look at http://blog.servermonitoringhq.com/posts/the_ultimate_web_based_ide http://blog.servermonitoringhq.com/posts/the_ultimate_web_ba...
  - SingAlong 15y ago
    Right! A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk, unless you are paranoid about securing your iron cage. If anyone has used the Seaside framework, can you throw some light on how this compares to the in-page editing that Seaside provides (as per what I've heard).
    - patio11 15y ago
      A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk One of your friends is named Firefox, and he does not take orders from you, he takes orders from me.
    - SingAlong 15y ago
      So people now downvote if they don't agree with you? sw33t. I would love to know a reason.
- sabat 15y ago
  Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development, this is invaluable and awesome.
  - tptacek 15y ago
    He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN. Now you're a cute cat picture away from attackers with direct TCP access to your database servers. Wee!
    - sabat 15y ago
      after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94. I have never, ever heard of such a thing, and would freak out if I did. 80% of companies? Maybe you've got stats to back this up, and my experience is merely anecdotal -- but I've never heard of a single instance of something so obviously stupid. SQL injection vulnerability, sure. XSRF, XSS vulnerability, sure. Running a database server on the same host as your app server, with the webserver running as the DBA user? Sure, it happens. Certainly someone is bound to misuse this gem as well. But that doesn't mean it's "a very bad idea". It's a very good idea. It's just that it takes knowledge and experience to run a web site, and some people have to find out the hard way.
      - tptacek 15y ago
        Everybody runs development machines that can (a) be spoken to by machines with human-driven browsers and (b) can speak to other machines. You're a dev/ops guy, I'm an appsec security assessor. I think we just look for different things. Trust me, this isn't just common it's standard practice. It's a clever bad idea. Minimal payoff. Maximum risk. Incidentally: I'm not sure I'm in love with this "everyone has to find out the hard way" notion. No, they don't. We can just tell them: DON'T RUN STUFF LIKE THIS, IT WILL HURT YOU. You have 20+ years of experience. Most people on HN do not; they see this, think "ooo, shiny", and install it. As a practitioner yourself, you have a responsibility --- in fact, if you're keeping that CISSP cert current, an obligation --- to step in and help that not happen. By the way: hey, you asked.
- ojilles 15y ago
  As patio11 already noted, this is a bad idea. Further more, I don't see what it solves? Can't you just ssh into the box, and have that window open? Isn't this a window manager problem rather than a "rake/infrastructure" problem?
jrom 15y ago
I think this is a pretty cool tool, for both development/staging and also for production in a very restricted way. Every site has some kind of admin panel. I see this like a phpMyAdmin on asteroids for rack apps. Definitely interesting.
- sabat 15y ago
  Except for extreme circumstances (emergency debugging) I wouldn't let this thing near production. For development, it's super-handy, though.
- mtogo 15y ago
  I see this like a phpMyAdmin on asteroids for rack apps. Dear christ, please do not ever put this near production.
- aaronbrethorst 15y ago
  phpMyAdmin on asteroids sounds about right. http://en.wikipedia.org/wiki/Cretaceous%E2%80%93Tertiary_extinction_event http://en.wikipedia.org/wiki/Cretaceous%E2%80%93Tertiary_ext...
mef 15y ago
Reading the headline, I was hoping this was a ruby-debug console in the localhost browser for the current request. Perhaps that can be shoehorned into rack-webconsole?
- cldwalker 15y ago
  You'd probably be interested in https://github.com/ryanb/enlighten https://github.com/ryanb/enlighten
masylum 15y ago
Cool! Firebug for the frontend, rack-webconsole for the backend.
damoncali 15y ago
Nice way to introduce Rack. Much better than the usual hello world. I wouldn't use it for obvious reasons, but I like the demo.
hemancuso 15y ago
This seems like a boon for anyone trying to develop and debug issues on Heroku
ghayes 15y ago
It's sweet to see internet browsers opening up for development within themselves. We can surely do this securely with some amount of effort. I'd love to see a world without the need for Eclipse / Aptana.
txus 15y ago
On the CSRF concern, which is totally valid, I've pushed a patch. From version 0.0.5 it uses a token to prevent this kind of attacks. https://github.com/codegram/rack-webconsole/commit/d5060d0e8f69a335fd6c501dfd2d6562ab342a4f https://github.com/codegram/rack-webconsole/commit/d5060d0e8...

104 points by rohitarondekar 15y ago

patio11 15y ago

This is a very bad idea.

deleted 15y ago
[deleted]
txus 15y ago
It is meant for development environments only. Nobody would risk putting a Ruby console in production :) In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.
- patio11 15y ago
  I would think long and hard about whether giving code execution privileges on your local machine to anyone who can convince you to click on a link is a good idea. Actually, this should not be either long or hard. Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.
  - nicholaides 15y ago
    Can you expand on this? What's the risk? What's the attack vector?
    - ciupicri 15y ago
      I think he's saying that someone can make you open a web page that includes an image with the proper src attribute and bang, your Rails site is broken.
      - tptacek 15y ago
        More likely, your whole data center.
        sabat 15y ago
        Hyperbolic.
        tptacek 15y ago
        I know you've been a dev/ops guy for 20 years and I respect the fact that your development machines are sealed in vaults, but I've gotten to assess more than half of the top 10 biggest Rails apps in the world over the past couple of years and trust me, you're just wrong about this. Development machines are within reach of developer browsers. Database machines are within reach of development machines.
        ssmoot 15y ago
        You've probably figured this out by now, but I'm pretty sure you're missing the point. From your other comments in this thread you appear to think that the machine needs to be internet-accessible. Have a public IP. Open Firewall. All that. The reason this is so dangerous is that it needs none of that. All it needs is for your development machine to have access to the internet. I open up a project, enable this, and run rackup locally. I then view your Twitter stream, where you've embedded a crafted link behind a URL shortener. Because that link is executed by me, you've now remotely executed code on my machine. Assuming I'm anything like most Rails shops you can probably get to a number of other machines through my machine.
    - tptacek 15y ago
      Cross-site request forgery. I should add though that even if this thing gets an XSRF token and it's secure, you might as well take the passwords off your SSH keys if you're running this, because you're coughing up an unprotected remote shell to anyone who can talk to a dev server once you turn this on.
    - irahul 15y ago
      > What's the attack vector? CSRF.
  - txus 15y ago
    You're right, that's a risk. I've opened an issue to implement a simple pseudorandom token to protect AJAX requests. What do you think? https://github.com/codegram/rack-webconsole/issues/4 https://github.com/codegram/rack-webconsole/issues/4
- ianpurton 15y ago
  I think you can achieve the same thing using shellinabox. Take a look at http://blog.servermonitoringhq.com/posts/the_ultimate_web_based_ide http://blog.servermonitoringhq.com/posts/the_ultimate_web_ba...
- SingAlong 15y ago
  Right! A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk, unless you are paranoid about securing your iron cage. If anyone has used the Seaside framework, can you throw some light on how this compares to the in-page editing that Seaside provides (as per what I've heard).
  - patio11 15y ago
    A dev server is for dev, even to show off the app to your friends you've got to remove this console. So IMHO, you don't have to worry about security if it's your tiny dev machine that runs on your desk One of your friends is named Firefox, and he does not take orders from you, he takes orders from me.
  - SingAlong 15y ago
    So people now downvote if they don't agree with you? sw33t. I would love to know a reason.
sabat 15y ago
Patrick, I love everything you post, normally. In this case, you've misunderstood. This is a development and test tool. If someone puts this into the production environment, he deserves what he gets. For development, this is invaluable and awesome.
- tptacek 15y ago
  He understands that. Like me (we've trained him well!), he does not have particularly great faith in the insulating powers of the words "development environment". At a minimum, after running this you are one Twitter shortened link away from losing your development machine. The link will probably show you a cute cat picture just like any other one. You'll only find out you lost the machine later. At worst, you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN. Now you're a cute cat picture away from attackers with direct TCP access to your database servers. Wee!
  - sabat 15y ago
    after running this you are one Twitter shortened link away from losing your development machine Who runs an internet-accessible development machine? Maybe I give the rest of the dev world too much credit. you're one of the 80% of companies that keeps development machines in your data center protected by a firewall/VPN I've been in Dev/Ops for about 20 years, and been working the internet since the web took off in '94. I have never, ever heard of such a thing, and would freak out if I did. 80% of companies? Maybe you've got stats to back this up, and my experience is merely anecdotal -- but I've never heard of a single instance of something so obviously stupid. SQL injection vulnerability, sure. XSRF, XSS vulnerability, sure. Running a database server on the same host as your app server, with the webserver running as the DBA user? Sure, it happens. Certainly someone is bound to misuse this gem as well. But that doesn't mean it's "a very bad idea". It's a very good idea. It's just that it takes knowledge and experience to run a web site, and some people have to find out the hard way.
    - tptacek 15y ago
      Everybody runs development machines that can (a) be spoken to by machines with human-driven browsers and (b) can speak to other machines. You're a dev/ops guy, I'm an appsec security assessor. I think we just look for different things. Trust me, this isn't just common it's standard practice. It's a clever bad idea. Minimal payoff. Maximum risk. Incidentally: I'm not sure I'm in love with this "everyone has to find out the hard way" notion. No, they don't. We can just tell them: DON'T RUN STUFF LIKE THIS, IT WILL HURT YOU. You have 20+ years of experience. Most people on HN do not; they see this, think "ooo, shiny", and install it. As a practitioner yourself, you have a responsibility --- in fact, if you're keeping that CISSP cert current, an obligation --- to step in and help that not happen. By the way: hey, you asked.
ojilles 15y ago
As patio11 already noted, this is a bad idea. Further more, I don't see what it solves? Can't you just ssh into the box, and have that window open? Isn't this a window manager problem rather than a "rake/infrastructure" problem?

jrom 15y ago

I think this is a pretty cool tool, for both development/staging and also for production in a very restricted way. Every site has some kind of admin panel. I see this like a phpMyAdmin on asteroids for rack apps. Definitely interesting.

sabat 15y ago
Except for extreme circumstances (emergency debugging) I wouldn't let this thing near production. For development, it's super-handy, though.
mtogo 15y ago
I see this like a phpMyAdmin on asteroids for rack apps. Dear christ, please do not ever put this near production.
aaronbrethorst 15y ago
phpMyAdmin on asteroids sounds about right. http://en.wikipedia.org/wiki/Cretaceous%E2%80%93Tertiary_extinction_event http://en.wikipedia.org/wiki/Cretaceous%E2%80%93Tertiary_ext...

mef 15y ago

Reading the headline, I was hoping this was a ruby-debug console in the localhost browser for the current request. Perhaps that can be shoehorned into rack-webconsole?

cldwalker 15y ago
You'd probably be interested in https://github.com/ryanb/enlighten https://github.com/ryanb/enlighten

masylum 15y ago

Cool! Firebug for the frontend, rack-webconsole for the backend.

damoncali 15y ago

Nice way to introduce Rack. Much better than the usual hello world. I wouldn't use it for obvious reasons, but I like the demo.

hemancuso 15y ago

This seems like a boon for anyone trying to develop and debug issues on Heroku

ghayes 15y ago

It's sweet to see internet browsers opening up for development within themselves. We can surely do this securely with some amount of effort. I'd love to see a world without the need for Eclipse / Aptana.

txus 15y ago

On the CSRF concern, which is totally valid, I've pushed a patch. From version 0.0.5 it uses a token to prevent this kind of attacks. https://github.com/codegram/rack-webconsole/commit/d5060d0e8f69a335fd6c501dfd2d6562ab342a4f https://github.com/codegram/rack-webconsole/commit/d5060d0e8...