# Mod\_ruby, require, and $SAFE **URL:** \ **Category:** Ruby\ **Created:** [January 22, 2007, 6:22pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/102990 "2007-01-22T18:22:00Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 22, 2007, 6:22pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/102990/1 "2007-01-22T18:22:00Z")
When running under mod\_ruby with the default $SAFE == 1, a file containing only this: require ‘active\_record’ will give a 500 response with the error: mod\_ruby: error in ruby mod\_ruby: /usr/lib64/ruby/site\_ruby/1.8/rubygems/source\_index.rb:73:in `read': Insecure operation - read (SecurityError) mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems/source_index.rb:73:in`load\_specification’ mod\_ruby: from /usr/lib64/ruby/site\_ruby/1.8/rubygems/source\_index.rb:45:in `from_installed_gems' mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems/source_index.rb:44:in`from\_installed\_gems’ mod\_ruby: from /usr/lib64/ruby/site\_ruby/1.8/rubygems/source\_index.rb:63:in `from_installed_gems' mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems.rb:79:in`source\_index’ mod\_ruby: from /usr/lib64/ruby/site\_ruby/1.8/rubygems/custom\_require.rb:105:in `init_gemspecs' mod_ruby: from /usr/lib64/ruby/site_ruby/1.8/rubygems/custom_require.rb:50:in`initialize’ mod\_ruby: from /usr/lib64/ruby/site\_ruby/1.8/rubygems/custom\_require.rb:24:in `require' mod_ruby: from /home/user/public_html/lvs/cgi/safe_test.rbx:1 mod_ruby: from /usr/lib64/ruby/1.8/apache/ruby-run.rb:53:in`handler’ I think this is happening because whatever is loaded from active\_record is tainted and then can’t be used to do the requires that active\_record needs to do. That could be way off though. I’m aware of the RubySafeLevel apache directive, but is there a reasonable way to keep $SAFE == 1 and still be able to require active\_record? Thanks, Jeremy ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 22, 2007, 8:21pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/102990/2 "2007-01-22T20:21:28Z")
On Jan 22, 2007, at 09:20, removed\_email\_address@domain.invalid wrote: > I think this is happening because whatever is loaded from > active\_record > is tainted and then can’t be used to do the requires that > active\_record > needs to do. That could be way off though. > > I’m aware of the RubySafeLevel apache directive, but is there a > reasonable way to keep $SAFE == 1 and still be able to require > active\_record? What version of RubyGems are you using? – Eric H. - removed\_email\_address@domain.invalid - [http://blog.segment7.net](http://blog.segment7.net) I LIT YOUR GEM ON FIRE! ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 22, 2007, 8:45pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/102990/3 "2007-01-22T20:45:33Z")
Eric H. wrote: > What version of RubyGems are you using? $ gem --version shows 0.8.11 Jeremy ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 22, 2007, 9:26pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/102990/4 "2007-01-22T21:26:39Z")
removed\_email\_address@domain.invalid wrote: > Eric H. wrote: > > > What version of RubyGems are you using? > > $ gem --version > shows 0.8.11 I just update RubyGems and now everything in my original script is working fine. If you don’t mind, could you give me a bit of detail about what went wrong and what was changed in later versions of Gems? To satisfy my curiosity more than anything. Thanks for the suggestion. Jeremy ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 22, 2007, 10:22pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/102990/5 "2007-01-22T22:22:47Z")
On Jan 22, 2007, at 12:25, removed\_email\_address@domain.invalid wrote: > To satisfy my curiosity more than anything. > I added $SAFE = 1 support to RubyGems in 0.9.0. Before that RubyGems > didn’t untaint objects and was incapable of working. – Eric H. - removed\_email\_address@domain.invalid - [http://blog.segment7.net](http://blog.segment7.net) I LIT YOUR GEM ON FIRE! ---
**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\ **Post date:** [January 22, 2007, 9:25pm UTC](https://www.ruby-forum.com/t/mod-ruby-require-and-safe/102990/6 "2007-01-22T21:25:39Z")
removed\_email\_address@domain.invalid wrote: > Eric H. wrote: > > > What version of RubyGems are you using? > > $ gem --version > shows 0.8.11 I just updated RubyGems and now everything in my original script is working fine. If you don’t mind, could you give me a bit of detail about what went wrong and what was changed in later versions of Gems? To satisfy my curiosity more than anything. Thanks for the suggestion. Jeremy