gpt4 book ai didi

ruby-on-rails - 在 Rails 项目中要求 'open-uri' 是否安全?

转载 作者:数据小太阳 更新时间:2023-10-29 07:47:35 24 4
gpt4 key购买 nike

我见过很多 open-uri 的例子,对于简单的事情来说它似乎非常棒。不过,要求它在全局范围内定义一个名为 open 的方法确实让我很困扰。

这尤其令人不安,因为在 Rails 5 控制台中四处寻找之后,似乎已经定义了一个名为 open 的方法:

irb(main):001:0> open
ArgumentError: wrong number of arguments (given 0, expected 1..3)
from (irb):1:in `initialize'
from (irb):1:in `open'
from (irb):1
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/console.rb:65:in `start'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/console_helper.rb:9:in `start'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/commands_tasks.rb:78:in `console'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/commands_tasks.rb:49:in `run_command!'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/command.rb:20:in `run'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands.rb:18:in `<top (required)>'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:302:in `require'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:302:in `block in require'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:268:in `load_dependency'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:302:in `require'
from /Users/ahamon/code/signist/bin/rails:9:in `<top (required)>'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:296:in `load'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:296:in `block in load'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:268:in `load_dependency'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:296:in `load'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/commands/rails.rb:6:in `call'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/command_wrapper.rb:38:in `call'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:185:in `block in serve'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:156:in `fork'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:156:in `serve'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:131:in `block in run'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:125:in `loop'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:125:in `run'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application/boot.rb:18:in `<top (required)>'
from /Users/ahamon/.rubies/ruby-2.3.0/lib/ruby/2.3.0/rubygems/core_ext/kernel_require.rb:55:in `require'
from /Users/ahamon/.rubies/ruby-2.3.0/lib/ruby/2.3.0/rubygems/core_ext/kernel_require.rb:55:in `require'
from -e:1:in `<main>'irb(main):002:0>

如果我继续require 'open-uri',返回值为true,我现在已经删除了之前的open ,不管它是什么:

irb(main):002:0> require 'open-uri'
=> true
irb(main):003:0> open
ArgumentError: wrong number of arguments (given 0, expected 1+)
from /Users/ahamon/.rubies/ruby-2.3.0/lib/ruby/2.3.0/open-uri.rb:29:in `open'
from (irb):3
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/console.rb:65:in `start'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/console_helper.rb:9:in `start'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/commands_tasks.rb:78:in `console'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands/commands_tasks.rb:49:in `run_command!'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/command.rb:20:in `run'
from /Users/ahamon/.gem/ruby/2.3.0/gems/railties-5.0.0.beta3/lib/rails/commands.rb:18:in `<top (required)>'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:302:in `require'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:302:in `block in require'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:268:in `load_dependency'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:302:in `require'
from /Users/ahamon/code/signist/bin/rails:9:in `<top (required)>'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:296:in `load'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:296:in `block in load'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:268:in `load_dependency'
from /Users/ahamon/.gem/ruby/2.3.0/gems/activesupport-5.0.0.beta3/lib/active_support/dependencies.rb:296:in `load'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/commands/rails.rb:6:in `call'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/command_wrapper.rb:38:in `call'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:185:in `block in serve'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:156:in `fork'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:156:in `serve'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:131:in `block in run'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:125:in `loop'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application.rb:125:in `run'
from /Users/ahamon/.gem/ruby/2.3.0/gems/spring-1.6.4/lib/spring/application/boot.rb:18:in `<top (required)>'
from /Users/ahamon/.rubies/ruby-2.3.0/lib/ruby/2.3.0/rubygems/core_ext/kernel_require.rb:55:in `require'
from /Users/ahamon/.rubies/ruby-2.3.0/lib/ruby/2.3.0/rubygems/core_ext/kernel_require.rb:55:in `require'
from -e:1:in `<main>'irb(main):004:0>

注意每个堆栈跟踪中指定的不同元数。

那么之前定义的open是什么呢?抹杀安全吗?有没有办法在不定义全局方法的情况下使用 open-uri?

最佳答案

openKernel#open ,不是 rails 。 open-uri包装 Kernel#open:它检查目标是否是 URL 或知道 #open,如果是则处理它,将所有内容传递给真正的 Kernel#open 如果不是。

因此,如果没有 open-uri,URL 将不起作用,openables 将不起作用,其他一切都可以。使用 open-uri,URL 可以工作,openables 可以工作,其他一切都是一样的。要求它应该没有危险,除了在 open-uri 检查您的参数是 URL 还是响应 #open 时非常非常轻微的性能影响。

关于ruby-on-rails - 在 Rails 项目中要求 'open-uri' 是否安全?,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/36394214/

24 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com