# Accessing a file with normal Ruby IO fails. Security issue of what?

**URL:** <https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924>\
**Category:** Rails\
**Created:** [November 23, 2008, 2:38am UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924 "2008-11-23T02:38:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![RichardOnRails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e0b2c6/32.png) [@RichardOnRails](https://www.ruby-forum.com/u/RichardOnRails)\
**Post date:** [November 23, 2008, 2:38am UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924/1 "2008-11-23T02:38:31Z")

</div>

Hi,

I’m developing a small Rails 2.2.0 app. I have a slightly modified  
scaffold-generated file,  
PayrollSys\app\controllers\cvs\_items\_controller.rb, as follows:

class CvsItemsController \< ApplicationController

# GET /cvs\_items

# GET /cvs\_items.xml

require ‘find’ # Added

def index  
logger.info “==\> index in cvs\_items\_controller.rb”  
# @cvs\_items = CvsItem.find(:all)  
@cvs\_items = get\_csv\_filenames\_attributes() # Replacement

[snip]

protected  
def reload  
logger.info "==\> Reload in cvs\_items\_controller.rb – RLM "  
end

def get\_csv\_filenames\_attributes # Brand new method  
csv\_data\_dir = “…/…/public/data/csv”  
values = []  
Find.find(csv\_data\_dir) do |item|  
next unless File.file?(item)  
values \<\< item  
end  
values  
end  
end

Using a logger, I have confirmed that no filenames have been returned  
by File.find and that the values array remains zero length.

However, the exact same method (without the “def” and its closing  
“end”), when added to a brother file in the same directory, correctly  
lists the two .csv files in the  
PayrollSys\public\data\csv directory (when a puts is prepended to the  
closing “values” symbol).

Is there some security method that precludes accessing the files?  
Would the tableless plugin be relevant, though I do want ActiveRecord  
to access the application database(s).

Thanks in Advance,  
Richard

---

<div class="post-metadata">

**Author:** ![RichardOnRails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e0b2c6/32.png) [@RichardOnRails](https://www.ruby-forum.com/u/RichardOnRails)\
**Post date:** [November 23, 2008, 3:27am UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924/2 "2008-11-23T03:27:30Z")

</div>

RichardOnRails wrote:

> Hi,
> 
> I’m developing a small Rails 2.2.0 app. I have a slightly modified  
> scaffold-generated file,  
> PayrollSys\app\controllers\cvs\_items\_controller.rb, as follows:
> 
> class CvsItemsController \< ApplicationController
> 
> # GET /cvs\_items
> 
> # GET /cvs\_items.xml
> 
> require ‘find’ # Added
> 
> def index  
> logger.info “==\> index in cvs\_items\_controller.rb”  
> # @cvs\_items = CvsItem.find(:all)  
> @cvs\_items = get\_csv\_filenames\_attributes() # Replacement
> 
> [snip]
> 
> protected  
> def reload  
> logger.info "==\> Reload in cvs\_items\_controller.rb – RLM "  
> end
> 
> def get\_csv\_filenames\_attributes  
> csv\_data\_dir = “…/…/public/data/csv”

do you mean “…/…/…/public/data/csv”?  
or you have a public dir under the app dir?

yes it is strange but you need to go 1 dir more back…

> ```
> values = []
> Find.find(csv_data_dir) do |item|
> next unless File.file?(item)
> values << item
> end
> values
> 
> ```
> 
> end  
> end
> 
> Using a logger, I have confirmed that no filenames have been returned  
> by File.find and that the values array remains zero length.

probably you are looking in the wrong dir

> However, the exact same method (without the “def” and its closing  
> “end”), when added to a brother file in the same directory, correctly  
> lists the two .csv files in the  
> PayrollSys\public\data\csv directory (when a puts is prepended to the  
> closing “values” symbol).
> 
> Is there some security method that precludes accessing the files?  
> Would the tableless plugin be relevant, though I do want ActiveRecord  
> to access the application database(s).
> 
> Thanks in Advance,  
> Richard

try this:

protected  
def reload  
logger.info "==\> Reload in cvs\_items\_controller.rb – RLM "  
end

```
def get_csv_filenames_attributes
  csv_data_dir = File.expand_path(File.dirname( __FILE__ ) +

```

“…/…/…/public/data/csv/”)  
logger.info “==\> csv\_data\_dir: #{csv\_data\_dir}” #print the dir so  
you can check if it is correct  
values = []  
Find.find(csv\_data\_dir) do |item|  
logger.info “==\> item in csv\_data\_dir: #{item}”  
next unless File.file?(item)  
values \<\< item  
end  
values  
end

Hope this help

Duilio R.

---

<div class="post-metadata">

**Author:** ![RichardOnRails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e0b2c6/32.png) [@RichardOnRails](https://www.ruby-forum.com/u/RichardOnRails)\
**Post date:** [November 23, 2008, 10:31am UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924/3 "2008-11-23T10:31:33Z")

</div>

Richard,

What you want is:

csv\_data\_dir = RAILS\_ROOT + “/public/data/csv”

Rick

On Nov 22, 3:37 pm, RichardOnRails

---

<div class="post-metadata">

**Author:** ![RichardOnRails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e0b2c6/32.png) [@RichardOnRails](https://www.ruby-forum.com/u/RichardOnRails)\
**Post date:** [November 23, 2008, 5:56pm UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924/4 "2008-11-23T17:56:06Z")

</div>

Hi Duilio,

Thanks for your responses. I’ll try them out today. I have a slight  
digression: in the process of removing my debugging code I managed to  
mess a few things up, which I’ll have to fix first. I’ll post back  
with the outcome.

> PS: I’m sorry for my English

No apology necessary. It’s not the form of your expression that  
matters, it’s the content of your message (with apologies to Martin  
Luther King’s memory.)

Best wishes,  
Richard

On Nov 22, 9:39 pm, Duilio R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![RichardOnRails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e0b2c6/32.png) [@RichardOnRails](https://www.ruby-forum.com/u/RichardOnRails)\
**Post date:** [November 23, 2008, 3:39am UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924/5 "2008-11-23T03:39:32Z")

</div>

Duilio R. wrote:

> RichardOnRails wrote:
> 
> > Hi,
> > 
> > I’m developing a small Rails 2.2.0 app. I have a slightly modified  
> > scaffold-generated file,  
> > PayrollSys\app\controllers\cvs\_items\_controller.rb, as follows:
> > 
> > class CvsItemsController \< ApplicationController
> > 
> > # GET /cvs\_items
> > 
> > # GET /cvs\_items.xml
> > 
> > require ‘find’ # Added
> > 
> > def index  
> > logger.info “==\> index in cvs\_items\_controller.rb”  
> > # @cvs\_items = CvsItem.find(:all)  
> > @cvs\_items = get\_csv\_filenames\_attributes() # Replacement
> > 
> > [snip]
> > 
> > protected  
> > def reload  
> > logger.info "==\> Reload in cvs\_items\_controller.rb – RLM "  
> > end
> > 
> > def get\_csv\_filenames\_attributes  
> > csv\_data\_dir = “…/…/public/data/csv”
> 
> do you mean “…/…/…/public/data/csv”?  
> or you have a public dir under the app dir?
> 
> yes it is strange but you need to go 1 dir more back…

no, my error  
is relative to the dir where you start rails

if you use  
ruby script/server  
and  
csv\_data\_dir = “public/data/csv”  
it works

> > ```
> > values = []
> > Find.find(csv_data_dir) do |item|
> > next unless File.file?(item)
> > values << item
> > end
> > values
> > 
> > ```
> > 
> > end  
> > end
> > 
> > Using a logger, I have confirmed that no filenames have been returned  
> > by File.find and that the values array remains zero length.
> 
> probably you are looking in the wrong dir
> 
> > However, the exact same method (without the “def” and its closing  
> > “end”), when added to a brother file in the same directory, correctly  
> > lists the two .csv files in the  
> > PayrollSys\public\data\csv directory (when a puts is prepended to the  
> > closing “values” symbol).
> > 
> > Is there some security method that precludes accessing the files?  
> > Would the tableless plugin be relevant, though I do want ActiveRecord  
> > to access the application database(s).
> > 
> > Thanks in Advance,  
> > Richard
> 
> try this:
> 
> protected  
> def reload  
> logger.info "==\> Reload in cvs\_items\_controller.rb – RLM "  
> end
> 
> ```
> def get_csv_filenames_attributes
> csv_data_dir = File.expand_path(File.dirname( __FILE__ ) +
> 
> ```
> 
> “…/…/…/public/data/csv/”)  
> logger.info “==\> csv\_data\_dir: #{csv\_data\_dir}” #print the dir so  
> you can check if it is correct  
> values = []  
> Find.find(csv\_data\_dir) do |item|  
> logger.info “==\> item in csv\_data\_dir: #{item}”  
> next unless File.file?(item)  
> values \<\< item  
> end  
> values  
> end
> 
> Hope this help
> 
> Duilio R.

Errata corrige

protected  
def reload  
logger.info "==\> Reload in cvs\_items\_controller.rb – RLM "  
end

```
def get_csv_filenames_attributes
  csv_data_dir = File.expand_path(File.dirname( __FILE__ ) +
                               "/../../public/data/csv/")
  values = []
  logger.info "==> csv_data_dir: #{csv_data_dir}"
  Find.find(csv_data_dir) do |item|
    next unless File.file?(item)
    logger.info "==> file in csv_data_dir: #{item}"
    values << item
  end
  values
end

```

I hope this is correct 😉

Duilio R.

PS: I’m sorry for my English

---

<div class="post-metadata">

**Author:** ![RichardOnRails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e0b2c6/32.png) [@RichardOnRails](https://www.ruby-forum.com/u/RichardOnRails)\
**Post date:** [November 23, 2008, 5:58pm UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924/6 "2008-11-23T17:58:28Z")

</div>

Hi Rick,

> csv\_data\_dir = RAILS\_ROOT + “/public/data/csv”

Now that looks like REAL Ruby-on-Rails programming.

Many thanks.

I’ll post back on success/failure later today or tomorrow.

Best wishes,  
Richard

---

<div class="post-metadata">

**Author:** ![RichardOnRails](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e0b2c6/32.png) [@RichardOnRails](https://www.ruby-forum.com/u/RichardOnRails)\
**Post date:** [November 26, 2008, 9:27pm UTC](https://www.ruby-forum.com/t/accessing-a-file-with-normal-ruby-io-fails-security-issue-of-what/153924/7 "2008-11-26T21:27:57Z")

</div>

Hey Rick,

RAILS\_ROOT was the key. I never would have dreamed that up by  
myself, despite my handsome collection of Rails books 🙂

Thanks and Best Wishes,  
Richard