# Acts\_as\_state\_machine: SecurityError calling insecure method

**URL:** <https://www.ruby-forum.com/t/acts-as-state-machine-securityerror-calling-insecure-method/146822>\
**Category:** Rails\
**Created:** [August 25, 2008, 10:09pm UTC](https://www.ruby-forum.com/t/acts-as-state-machine-securityerror-calling-insecure-method/146822 "2008-08-25T22:09:54Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![teddio](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b3f665/32.png) [@teddio](https://www.ruby-forum.com/u/teddio)\
**Post date:** [August 25, 2008, 10:09pm UTC](https://www.ruby-forum.com/t/acts-as-state-machine-securityerror-calling-insecure-method/146822/1 "2008-08-25T22:09:54Z")

</div>

(also posted on rails forum:  
[http://railsforum.com/viewtopic.php?id=21744](http://railsforum.com/viewtopic.php?id=21744), then I discovered this  
lilst and there are many more people…)

Hi, since yesterday I suddenly recieve lots of such messages in my  
logfiles - and everything in the user model that uses that plugin fails!

My deployed Rails code hasn’t changeed in 5 days, and those errors  
started to appear only a day ago. I’m at a loss to explain it!

What could it mean? Thanks!!!

PS: I checked my logs. No one was logged in (this is not meant to be a  
“hacker detection”, it just means neither I nor my co-workers deployed  
or changed anything), no updates of anything were installed (the rails  
app or system packages). I got the first error a day ago, so I can  
pinpoint the time pretty well. I just did a fresh deploy (using  
capistrano), tried and did not get an error in those places that had  
them. Very, very, very strange - problem is, I don’t really know what  
that error even means. Not even after seeing the place in the ruby  
source code where it’s raised (while searching the web for this error  
message). Also, there seem to be precious little other webpages/messages  
to find when searching for this error (at least none that seem relevant,  
and the only one that DID look similar didn’t have responses).

---

<div class="post-metadata">

**Author:** ![teddio](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/b3f665/32.png) [@teddio](https://www.ruby-forum.com/u/teddio)\
**Post date:** [September 5, 2008, 11:01pm UTC](https://www.ruby-forum.com/t/acts-as-state-machine-securityerror-calling-insecure-method/146822/2 "2008-09-05T23:01:27Z")

</div>

I ran into a similar problem with acts\_as\_state\_machine. All of a  
sudden, running a transition action resulted in a SecurityError  
exception with the message "calling an insecure method: ". I changed the definition of  
run\_transition\_action in the acts\_as\_state\_machine.rb file to be:

```
    def run_transition_action(action)
     Symbol === action ? self.method(action).untaint.call :

```

action.call(self)  
end

and it seems to solve the immediate problem for now.

JCBC

On Aug 25, 4:09 pm, Michael Hasenstein \<rails-mailing-l…@andreas-