# Insecure operation

**URL:** <https://www.ruby-forum.com/t/insecure-operation/146913>\
**Category:** Ruby\
**Created:** [August 26, 2008, 7:05pm UTC](https://www.ruby-forum.com/t/insecure-operation/146913 "2008-08-26T19:05:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [August 26, 2008, 7:05pm UTC](https://www.ruby-forum.com/t/insecure-operation/146913/1 "2008-08-26T19:05:32Z")

</div>

Hello!

I’m trying to make a CGI script which uses modules from Rails, and  
I’ve got a “Security Error”. I have read posts about taint/untaint,  
but nothing helps. Could you advice something?

Details:  
FreeBSD 6.3-STABLE  
Rails 2.1.0  
Ruby 1.8.6  
Apache 2.2 + mod\_ruby (for CGI) + latest Phusion Passenger + latest  
Ruby Enterprise (for Rails)

Script:  
require ‘cgi’  
require ‘…/config/environment’  
params = CGI::parse( ENV[‘QUERY\_STRING’] ).each{ |key, el| {key =\>  
el.first} } #I don’t know how to get GET vars in another way  
seller = ContrSeller.find( :first, :conditions =\> { :id =\>  
params[‘seller\_id’], :password =\> params[‘pass’] } ) #ContrSeller - is  
an existing model

Error:  
mod\_ruby: error in ruby  
mod\_ruby: /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/lib/  
active\_support/dependencies.rb:169:in `file?’: Insecure operation -  
file? (SecurityError)

I can put a full error output here, but it’s not needed.  
I have tried to untaint() params variable and its values, but no  
success.

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [August 27, 2008, 7:20am UTC](https://www.ruby-forum.com/t/insecure-operation/146913/2 "2008-08-27T07:20:49Z")

</div>

On 26 Á×Ç, 21:04, removed\_email\_address@domain.invalid wrote:

> I can put a full error output here, but it’s not needed.

Here is a full error report:  
mod\_ruby: error in ruby  
mod\_ruby: /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/lib/  
active\_support/dependencies.rb:169:in `file?': Insecure operation - file? (SecurityError) mod_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/ lib/active_support/dependencies.rb:169:in`search\_for\_file’  
mod\_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/  
lib/active\_support/dependencies.rb:167:in `each' mod_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/ lib/active_support/dependencies.rb:167:in`search\_for\_file’  
mod\_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/  
lib/active\_support/dependencies.rb:258:in `load_missing_constant' mod_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/ lib/active_support/dependencies.rb:483:in`const\_missing’  
mod\_ruby: from ./pcapi.rb:6:in `new_session' mod_ruby: from /home/gs/data/www/pc.gorodskidok.com/api/api.rbx:43 mod_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/ lib/active_support/dependencies.rb:502:in`load’  
mod\_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/  
lib/active\_support/dependencies.rb:502:in `load' mod_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/ lib/active_support/dependencies.rb:354:in`new\_constants\_in’  
mod\_ruby: from /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/  
lib/active\_support/dependencies.rb:502:in `load' mod_ruby: from /usr/local/lib/ruby/site_ruby/1.8/apache/ruby-run.rb: 53:in`handler’

I have tried  
$SAFE = 0  
But it returns a error that security level cannot be downgraded