Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      CodeSOD: A Unique Way to Primary Key

      July 22, 2025

      BrowserStack launches Figma plugin for detecting accessibility issues in design phase

      July 22, 2025

      Parasoft brings agentic AI to service virtualization in latest release

      July 22, 2025

      Node.js vs. Python for Backend: 7 Reasons C-Level Leaders Choose Node.js Talent

      July 21, 2025

      The best CRM software with email marketing in 2025: Expert tested and reviewed

      July 22, 2025

      This multi-port car charger can power 4 gadgets at once – and it’s surprisingly cheap

      July 22, 2025

      I’m a wearables editor and here are the 7 Pixel Watch 4 rumors I’m most curious about

      July 22, 2025

      8 ways I quickly leveled up my Linux skills – and you can too

      July 22, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      The Intersection of Agile and Accessibility – A Series on Designing for Everyone

      July 22, 2025
      Recent

      The Intersection of Agile and Accessibility – A Series on Designing for Everyone

      July 22, 2025

      Zero Trust & Cybersecurity Mesh: Your Org’s Survival Guide

      July 22, 2025

      Execute Ping Commands and Get Back Structured Data in PHP

      July 22, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      A Tomb Raider composer has been jailed — His legacy overshadowed by $75k+ in loan fraud

      July 22, 2025
      Recent

      A Tomb Raider composer has been jailed — His legacy overshadowed by $75k+ in loan fraud

      July 22, 2025

      “I don’t think I changed his mind” — NVIDIA CEO comments on H20 AI GPU sales resuming in China following a meeting with President Trump

      July 22, 2025

      Galaxy Z Fold 7 review: Six years later — Samsung finally cracks the foldable code

      July 22, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»News & Updates»CodeSOD: A Ruby Encrusted Footgun

    CodeSOD: A Ruby Encrusted Footgun

    April 1, 2025

    Many years ago, JP joined a Ruby project. This was in the heyday of Ruby, when every startup on Earth was using it, and if you weren’t building your app on Rails, were you even building an app?

    Now, Ruby offers a lot of flexibility. One might argue that it offers too much flexibility, especially insofar as it permits “monkey patching”: you can always add new methods to an existing class, if you want. Regardless of the technical details, JP and the team saw that massive flexibility and said, “Yes, we should use that. All of it!”

    As these stories usually go, that was fine- for awhile. Then one day, a test started failing because a class name wasn’t defined. That was already odd, but what was even odder is that when they searched through the code, that class name wasn’t actually used anywhere. So yes, there was definitely no class with that name, but also, there was no line of code that was trying to instantiate that class. So where was the problem?

    def controller_class(name)
      "#{settings.app_name.camelize}::Controllers".constantize.const_get("#{name.to_s.camelize}")
    end
    
    def model_class(name)
      "#{settings.app_name.camelize}".constantize.const_get("#{name.to_s.camelize}")
    end
    
    def resource_class(name)
      "#{settings.app_name.camelize}Client".constantize.const_get("#{name.to_s.camelize}")
    end
    

    It happened because they were dynamically constructing the class names from a settings field. And not just in this handful of lines- this pattern occurred all over the codebase. There were other places where it referenced a different settings field, and they just hadn’t encountered the bug yet, but knew that it was only a matter of time before changing a settings file was going to break more functionality in the application.

    They wisely rewrote these sections to not reference the settings, and dubbed the pattern the “Caramelize Pattern”. They added that to their coding standards as a thing to avoid, and learned a valuable lesson about how languages provide footguns.

    Since today’s April Fool’s Day, consider the prank the fact that everyone learned their lesson and corrected their mistakes. I suppose that has to happen at least sometimes.

    [Advertisement]
    Keep the plebs out of prod. Restrict NuGet feed privileges with ProGet. Learn more.

    Source: Read More 

    Facebook Twitter Reddit Email Copy Link
    Next Article ArchiveKeep keeps your files archived in multiple places

    Related Posts

    News & Updates

    The best CRM software with email marketing in 2025: Expert tested and reviewed

    July 22, 2025
    News & Updates

    This multi-port car charger can power 4 gadgets at once – and it’s surprisingly cheap

    July 22, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    These 6 Linux apps are the secret sauce to my creative process

    News & Updates

    ZeroSearch from Alibaba Uses Reinforcement Learning and Simulated Documents to Teach LLMs Retrieval Without Real-Time Search

    Machine Learning

    Snowflake Charts New AI Territory: Cortex AISQL & Snowflake Intelligence Poised to Reshape Data Analytics

    Machine Learning

    How Attackers Target Travelers – and How to Defend Yourself

    Development

    Highlights

    Laravel Routing

    May 10, 2025

    Routes are your Laravel Application’s entry point, defining how it responds to different URLS and…

    CVE-2025-20298 – Splunk Universal Forwarder Windows Privilege Escalation Vulnerability

    June 2, 2025

    CVE-2025-3884 – Cloudera Hue Ace Editor Directory Traversal Information Disclosure

    May 22, 2025

    OpenAI introduces “ChatGPT agent” as the ultimate jack of all AI trades — with its own computer to check out your to-do list

    July 18, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.