CodeVetter · Repo Unpack · Risk map
rails/rails
The dangerous paths are the ones that eval, shell out, decrypt secrets, or accept network input before an app's own auth. CSRF and host authorization changed meaning across load_defaults versions, so an edit that looks local can change every newly generated app. Several public framework routes (health, storage, mailbox ingress) are safe only when the app understands their actual guarantees. The release webhook and the local .Gemfile hook are smaller but real trust boundaries.
- RunnerCommand evals stdin or an arbitrary string in TOPLEVEL_BINDING after boot_application! and Rails.application.load_runner. That is an intentional RCE surface for anyone who can invoke bin/rails runner.
- Credentials editing shells out with system(*Shellwords.split(ENV['VISUAL'] or ENV['EDITOR']), tempfile). Shellwords reduces word-splitting surprises, but the editor string is still an executable chosen by the environment, and a forking editor that does not wait will cause an immediate re-encrypt of an unedited file.
- EncryptedFile follows ENV then key file, uses AES-128-GCM, and rejects keys whose length is not expected_key_length. Missing keys raise MissingKeyError naming both the key path and the env var. Invalid ciphertext surfaces as MessageEncryptor::InvalidMessage, which credentials diff and edit rescue and sometimes print the raw encrypted file.
- If SECRET_KEY_BASE and credentials are both empty in a local environment, secret_key_base generates and stores a secret in tmp/local_secret.txt. SECRET_KEY_BASE_DUMMY forces that path so assets:precompile can run without production secrets. A dummy secret shipped into a real environment would make cookie and message forgeries trivial.
- HostAuthorization exists to stop DNS rebinding. It returns 403 via a default response_app when the host is not permitted, and logs the blocked host at error. ALLOWED_HOSTS_IN_DEVELOPMENT is .localhost, .test, 0.0.0.0/0, and ::/0. config.host_authorization exclude can opt a path out.
- load_defaults 8.2 sets forgery_protection_verification_strategy to :header_only, default_protect_from_forgery_with to :exception, and removes X-XSS-Protection and X-Download-Options from the default security headers. Apps that stay on an older load_defaults keep the previous token-based behavior. protect_from_forgery without an explicit with: warns when the default is still :null_session.
- sanitize_sql_for_conditions returns a String argument unchanged, so callers who pass an already-interpolated SQL fragment get no quoting. The safe form is the array or named-bind form. This is the classic injection footgun at the framework boundary.
- Rails::HealthController#show returns 200 whenever rendering succeeds. The class comment states it does not check the database or Redis, and that pointing a load balancer at it can restart pods for the wrong reason if an app later adds those checks carelessly.
- Action Mailbox mounts POSTs at /rails/action_mailbox/{postmark,relay,sendgrid,mandrill}/inbound_emails and /rails/action_mailbox/mailgun/inbound_emails/mime on the application routes, plus a conductor that can create and incinerate emails. Those ingress controllers are the authentication boundary for inbound mail; the route file itself does not show a shared secret check.
- Active Storage exposes signed_id blob and representation URLs and a disk service PUT /disk/:encoded_token plus direct upload creation. Confidentiality of stored files depends on signed-id expiry and the service, not on a session.
- Rakefile task publish_docs POSTs to http://api.rubyonrails.org:8080/rails-master-hook with Net::HTTP and no credentials in the request. The comment says a GitHub webhook is what normally triggers doc publishing, and that humans should not run the task.
- The root Gemfile instance_evals ./.Gemfile when that file exists, so a local untracked file executes during every bundle install of the framework.
- load_defaults is a single case ladder from 5.0 through 8.2 where each version calls the previous one. Changing an assignment inside when 8.2, or inserting a version in the wrong place, changes defaults for every app that generated config.load_defaults at that version. The generator writes that call into config/application.rb.
- load_defaults 8.0 sets Regexp.timeout ||= 1 when the Ruby supports it, which can raise on previously legal long matches. 8.1 turns YJIT off when Rails.env.local? and on otherwise. Both are process-wide, not per-request.
- Railtie initializers share one ordered list with the application. A before/after name that does not match, or a railtie loaded after initialize!, silently misses the boot. rails/all.rb's require order is the supported composition order, and Releaser::FRAMEWORKS comments that Action Mailbox must follow Active Record.