# How to make this secure?

**URL:** <https://www.ruby-forum.com/t/how-to-make-this-secure/73908>\
**Category:** Rails\
**Created:** [October 27, 2006, 9:52pm UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908 "2006-10-27T21:52:29Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [October 27, 2006, 9:52pm UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/1 "2006-10-27T21:52:29Z")

</div>

Hi everyone,

I’m writing a piece of software where I receive the name of an active  
record class from the outside (in the request\_uri) and want to make a  
lookup on whether this active record class exists. Then, I need to do a  
.find(…) and whatever on that class.

The following lines do exactly what I want, however, they are  
completely _NOT_ secure 🙂

def get\_activerecord\_named(name)  
activerecord = eval(name)  
if activerecord.superclass == ActiveRecord::Base  
return activerecord  
else  
return nil  
end  
end

Anyone has a better idea?

A switch/case is not an option as I don’t know the names of all  
existing active record classes at design time. However, could one find  
out the names of all available active record classes at run time?

Thank you, your help is very appreciated!

–jan

---

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [October 27, 2006, 10:56pm UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/2 "2006-10-27T22:56:36Z")

</div>

Populate a list of models at server startup?

---

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [October 28, 2006, 1:20am UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/3 "2006-10-28T01:20:46Z")

</div>

how would you do that?

---

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [October 28, 2006, 11:09am UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/4 "2006-10-28T11:09:09Z")

</div>

yeah wrote:

> def get\_activerecord\_named(name)  
> A switch/case is not an option as I don’t know the names of all  
> existing active record classes at design time. However, could one find  
> out the names of all available active record classes at run time?

ActiveRecord::Base only finds out about its subclasses when they are  
loaded. I think it’s easier to follow your approach, finding the named  
class (if there is one), and then finding out if its superclass is  
ActiveRecord::Base. (Note that if you start introducing inheritance  
among your model classes you will need to extend this to look beyond the  
direct superclass.)

Try this:

def get\_activerecord\_named(name)  
c = name.constantize rescue nil  
if c.class == Class && c.superclass == ActiveRecord::Base  
return c  
else  
return nil  
end  
end

Rails adds the constantize method to String, to return the value of the  
constant named by the String. If there isn’t one, it raises a NameError  
exception - the “rescue nil” clause catches this.

In the if statement, c could be nil, or some non-class constant value,  
or a class - so a check that it’s a class is needed before trying to  
invoke its superclass method.

regards

Justin F.

---

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [October 28, 2006, 11:39am UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/5 "2006-10-28T11:39:09Z")

</div>

Thank you, Justin. That looks great!

---

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [November 7, 2006, 11:07am UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/6 "2006-11-07T11:07:25Z")

</div>

Where are the ruby logs on Mac OS X Tiger?

I need to see the SQL commands the update\_all method of ActiveRecord is  
sending. Manually running the output of

```
class MyTable < ActiveRecord: end
puts "UPDATE my_table SET #{updates} WHERE #{conditions}
MyTABLE.update_all(updates, conditions)

```

yeilds very different results from the result of the command. scope is  
not  
set, so should not be a factor.

Seeing what ActiveRecord is saying to MySQL would really help.

Thanks,  
Ric Turley

---

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [November 7, 2006, 11:07am UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/7 "2006-11-07T11:07:39Z")

</div>

Thanks for the reply.

Actually, I am doing the “Use ActiveRecord Outside of Rails” trick as I  
haven’t figured out how to do the user interface yet. I am writing a  
method  
to move a sub-tree in an acts\_as\_nested\_set module.

Hence, I am trying to find the Ruby logs rather than the Rails logs.

Thanks again,  
Ric Turley

---

<div class="post-metadata">

**Author:** ![yeah](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/dbc845/32.png) [@yeah](https://www.ruby-forum.com/u/yeah)\
**Post date:** [November 7, 2006, 11:07am UTC](https://www.ruby-forum.com/t/how-to-make-this-secure/73908/8 "2006-11-07T11:07:32Z")

</div>

Look at your log/development.log. Also the query\_trace plugin will be  
useful.

Vish