# Mod\_ruby + WSDL = security error

**URL:** <https://www.ruby-forum.com/t/mod-ruby-wsdl-security-error/64055>\
**Category:** Ruby\
**Created:** [June 21, 2006, 6:09pm UTC](https://www.ruby-forum.com/t/mod-ruby-wsdl-security-error/64055 "2006-06-21T18:09:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![pnomolos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/85f322/32.png) [@pnomolos](https://www.ruby-forum.com/u/pnomolos)\
**Post date:** [June 21, 2006, 6:09pm UTC](https://www.ruby-forum.com/t/mod-ruby-wsdl-security-error/64055/1 "2006-06-21T18:09:15Z")

</div>

When trying to create a handler to access a SOAP server in an embedded  
ruby file (.rhtml) I am unable to get anything done unless I decrease  
the safe level for ruby to 0. The code is the following:

\<%  
require ‘soap/wsdlDriver’  
require ‘soap/rpc/rpc’  
require ‘cgi’  
require ‘logger’

log = Logger.new(STDERR)

log.info $SAFE

file = ‘QBXMLRemote.wsdl’

soapFactory = SOAP::WSDLDriverFactory.new(file)  
soap = soapFactory.create\_rpc\_driver

connectString = soap.openConnectionAndBeginSession ‘u’, ‘p’ , ‘’,  
‘someName’, ‘’, ‘multiUser’  
puts connectString  
%\>

When it runs at $SAFE = 1 I get the following stack trace:

[Wed Jun 21 09:06:45 2006] [error] mod\_ruby: error in ruby  
[Wed Jun 21 09:06:45 2006] [error] mod\_ruby:  
/usr/lib/ruby/1.8/http-access2.rb:1283:in `initialize': Insecure operation - initialize (SecurityError) [Wed Jun 21 09:06:45 2006] [error] mod_ruby: from /usr/lib/ruby/1.8/http-access2.rb:1283:in`create\_socket’  
[Wed Jun 21 09:06:45 2006] [error] mod\_ruby: from  
/usr/lib/ruby/1.8/http-access2.rb:1252:in `connect' [Wed Jun 21 09:06:45 2006] [error] mod_ruby: from /usr/lib/ruby/1.8/timeout.rb:56:in`timeout’  
[Wed Jun 21 09:06:45 2006] [error] mod\_ruby: from  
/usr/lib/ruby/1.8/timeout.rb:76:in `timeout' [Wed Jun 21 09:06:45 2006] [error] mod_ruby: from /usr/lib/ruby/1.8/http-access2.rb:1251:in`connect’  
[Wed Jun 21 09:06:45 2006] [error] mod\_ruby: from  
/usr/lib/ruby/1.8/http-access2.rb:1111:in `query' [Wed Jun 21 09:06:45 2006] [error] mod_ruby: from /usr/lib/ruby/1.8/http-access2.rb:833:in`query’  
[Wed Jun 21 09:06:45 2006] [error] mod\_ruby: from  
/usr/lib/ruby/1.8/http-access2.rb:383:in `do_get_block' [Wed Jun 21 09:06:45 2006] [error] mod_ruby: ... 9 levels... [Wed Jun 21 09:06:45 2006] [error] mod_ruby: from /var/www/qBooks/qBooks.rhtml:17 [Wed Jun 21 09:06:45 2006] [error] mod_ruby: from (eval):0 [Wed Jun 21 09:06:45 2006] [error] mod_ruby: from /usr/lib/ruby/1.8/apache/eruby-run.rb:116:in`run’  
[Wed Jun 21 09:06:45 2006] [error] mod\_ruby: from  
/usr/lib/ruby/1.8/apache/eruby-run.rb:72:in `handler’

Any clues as to why running at $SAFE = 1 isn’t working for me? I’m  
geussing that perhaps when I load the external .WSDL file it is marked  
as tainted?

Thanks

---

<div class="post-metadata">

**Author:** ![pnomolos](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/85f322/32.png) [@pnomolos](https://www.ruby-forum.com/u/pnomolos)\
**Post date:** [July 16, 2006, 4:53am UTC](https://www.ruby-forum.com/t/mod-ruby-wsdl-security-error/64055/2 "2006-07-16T04:53:25Z")

</div>

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1

Hi,

Philip S. wrote:

> When trying to create a handler to access a SOAP server in an embedded  
> ruby file (.rhtml) I am unable to get anything done unless I decrease  
> the safe level for ruby to 0. The code is the following:

> Any clues as to why running at $SAFE = 1 isn’t working for me? I’m  
> geussing that perhaps when I load the external .WSDL file it is marked  
> as tainted?

Yes. Host/port definition scraped from WSDL are tainted.

Generating client stub from WSDL on the fly is expensive even if you use  
it in mod\_ruby. Please consider to generate static client stub file  
with wsdl2ruby.rb and use it. Then host/port definitions are in stub  
file so no SecurityError will be thrown.

Regards,  
// NaHi  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1.4.2.1 (Cygwin)

iQEVAwUBRLmphB9L2jg5EEGlAQKW5ggAmlMeZy60EEobydIqbcFsywAemPU03DvH  
C8+HfxcA4IyRPjFDozYkC2kti9Um9Iqb2rqwx33SiKSkwm3u06rTaPaLmP0IkYTT  
3SQrkjZ8KUecFFI+3dipWX6+lQDr36Ate4xbVTci13IKc1YIYLD5I+uno6+yz+Z2  
OW0YAhIqsnPWSHzh1YtrefwE8QK8ygciup9Fr/3r+wY8ufjVyoBV3gNiOBNdekrr  
ORM//TGVSVK8YZxUiGN7NIrMKzngoADk94LCIVoL8vy20R9M7saV3Bg9LwfEz6uJ  
oB4rm+VBxdSl+ddfep76Z2LGeHOGLLIByHhQCWLPoqQLyIbFo/vvtA==  
=3OXp  
-----END PGP SIGNATURE-----