# Eruby and/or mod\_ruby on apache not working with rubygem **URL:** \ **Category:** Ruby\ **Created:** [September 26, 2010, 4:55am UTC](https://www.ruby-forum.com/t/eruby-and-or-mod-ruby-on-apache-not-working-with-rubygem/195593 "2010-09-26T04:55:01Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![mysteri](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/71e660/32.png) [@mysteri](https://www.ruby-forum.com/u/mysteri)\ **Post date:** [September 26, 2010, 4:55am UTC](https://www.ruby-forum.com/t/eruby-and-or-mod-ruby-on-apache-not-working-with-rubygem/195593/1 "2010-09-26T04:55:01Z")
Hi, I’m a web developer and wanted to try ruby. I installed ruby 1.8 on my debian server with eruby and mod\_ruby for apache2. Apache config files are configured correctly to accept .rhtml files and parse them. If I type sth like \<% print “Test” %\> then there’s no problem, it gives me “Test” as output. But I wanted to try “Twitterland” from rubygems. I installed the gem and when I’m trying to use the following: * * * require ‘rubygems’ require ‘twitterland’ ## print Twitterland::FollowCost.show(‘johnygoerend’) it works fine when I use it with “ruby index.rhtml”, but when I call it in my browser (of course with the \<% %\> tags) then I get these errors in my error.log: [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: error in ruby [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: /usr/local/lib/site\_ruby/1.8/rubygems.rb:472:in `[]’: Insecure operation - [] (SecurityError) [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from /usr/local/lib/site\_ruby/1.8/rubygems.rb:472:in `find_files' [Sun Sep 26 04:21:25 2010] [error] mod_ruby: from /usr/local/lib/site_ruby/1.8/rubygems.rb:471:in`map’ [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from /usr/local/lib/site\_ruby/1.8/rubygems.rb:471:in `find_files' [Sun Sep 26 04:21:25 2010] [error] mod_ruby: from /usr/local/lib/site_ruby/1.8/rubygems.rb:983:in`load\_plugins’ [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from /usr/local/lib/site\_ruby/1.8/rubygems.rb:1139 [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from /usr/lib/ruby/1.8/auto-reload.rb:77:in `load' [Sun Sep 26 04:21:25 2010] [error] mod_ruby: from /usr/lib/ruby/1.8/auto-reload.rb:77:in`require’ [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from /var/www/virtual/johny.lu/ruby/htdocs/index.rhtml:2 [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from (eval):0 [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from /usr/lib/ruby/1.8/apache/eruby-run.rb:116:in `eval_string_wrap' [Sun Sep 26 04:21:25 2010] [error] mod_ruby: from /usr/lib/ruby/1.8/apache/eruby-run.rb:116:in`run’ [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: from /usr/lib/ruby/1.8/apache/eruby-run.rb:72:in `handler’ I searched in google but there’s not much to find. Does anyone has an idea what exactly goes wrong here? ---
**Author:** ![mysteri](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/71e660/32.png) [@mysteri](https://www.ruby-forum.com/u/mysteri)\ **Post date:** [September 27, 2010, 1:05pm UTC](https://www.ruby-forum.com/t/eruby-and-or-mod-ruby-on-apache-not-working-with-rubygem/195593/2 "2010-09-27T13:05:31Z")
> [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: error in ruby > [Sun Sep 26 04:21:25 2010] [error] mod\_ruby: > /usr/local/lib/site\_ruby/1.8/rubygems.rb:472:in `[]’: Insecure operation > > - [] (SecurityError) My guess would be that mod\_ruby is running with $SAFE \> 0, but rubygems and/or twitterland doesn’t work in those conditions. Try showing SAFE=\<%= $SAFE %\> to see if that theory is right. Also try running your standalone ruby script with ruby -T1 (or add $SAFE=1 to the top) to see if it barfs in the same way. Aside: I’m afraid you’ll find not many people use mod\_ruby these days. As far as I can see, most people write Rack-based web apps. To run them with Apache you’d either proxy to a standalone ruby webserver (mongrel/thin/unicorn/rainbows!), or inside Apache using Phusion Passenger, a.k.a. mod\_rails. That’s not to say that you can’t make it work, it’s just that you might not find many other people using mod\_ruby to help you if you have problems. Equally, if a particular app or library doesn’t work with $SAFE=1, perhaps it should be modified so that it does. Regards, Brian. ---
**Author:** ![mysteri](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/71e660/32.png) [@mysteri](https://www.ruby-forum.com/u/mysteri)\ **Post date:** [September 27, 2010, 1:06pm UTC](https://www.ruby-forum.com/t/eruby-and-or-mod-ruby-on-apache-not-working-with-rubygem/195593/3 "2010-09-27T13:06:10Z")
Oh, forgot to include this link: [http://ruby-doc.org/docs/ProgrammingRuby/html/taint.html](http://ruby-doc.org/docs/ProgrammingRuby/html/taint.html) ---
**Author:** ![mysteri](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/71e660/32.png) [@mysteri](https://www.ruby-forum.com/u/mysteri)\ **Post date:** [September 27, 2010, 2:48pm UTC](https://www.ruby-forum.com/t/eruby-and-or-mod-ruby-on-apache-not-working-with-rubygem/195593/4 "2010-09-27T14:48:40Z")
Thank you very much for your answer. Safe really is set to 1 so you’re right. But running the script with ruby -T1 gives me the same as running it without -T1, so no error. Thanks for the notice on mod\_ruby. I guess I’ll have a look at the alternatives to run my ruby web apps. ---
**Author:** ![mysteri](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/71e660/32.png) [@mysteri](https://www.ruby-forum.com/u/mysteri)\ **Post date:** [September 27, 2010, 3:32pm UTC](https://www.ruby-forum.com/t/eruby-and-or-mod-ruby-on-apache-not-working-with-rubygem/195593/5 "2010-09-27T15:32:20Z")
Johny Goerend wrote: > Thank you very much for your answer. Safe really is set to 1 so you’re > right. But running the script with ruby -T1 gives me the same as running > it without -T1, so no error. Odd. Could you try: puts “foo”.tainted? in both scenarios. Also, you could try running mod\_ruby with RubySafeLevel 0 [http://www.modruby.net/en/index.rbx?mode=search&word=shugo#label-17](http://www.modruby.net/en/index.rbx?mode=search&word=shugo#label-17)