# Safety of Raising Exception

**URL:** <https://www.ruby-forum.com/t/safety-of-raising-exception/103448>\
**Category:** Rails\
**Created:** [May 6, 2007, 6:19am UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448 "2007-05-06T06:19:59Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 6, 2007, 6:19am UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/1 "2007-05-06T06:19:59Z")

</div>

Let’s say I have a url like

/controller/method/id?some\_param=whatever

if I put some\_param into an exception, such as

raise MyException, “I don’t like the value #{some\_param}”

or

log(“I don’t like the value #{some\_param}”)

I’m trying to inject filesystem calls into the raised exception. I’m  
seeing some application failures, but haven’t quite got it refined.  
However, it implies to me that it is having some effect on the  
application.

This seems to me the filesystem equivalent of SQL injection, but I  
don’t see it listed anywhere.

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 6, 2007, 7:14am UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/2 "2007-05-06T07:14:03Z")

</div>

Does this mean you’re passing some\_param to a system call? I guess  
the proper term for that would be “code injection” (http://  
[Code injection - Wikipedia](http://en.wikipedia.org/wiki/Code_injection)).

You should escape some\_param somehow before passing it to a call on  
the command line. If you could paste some example code of what you’re  
doing, we could probably provide pointers on how to make it safe…

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 6, 2007, 8:17am UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/3 "2007-05-06T08:17:05Z")

</div>

Sure, here’s an example using log, and one using exceptions:

Assuming there is a parameter klass, which is used as the class for  
lookup:

/controller/method/id?klass=Blog

def list  
begin  
raise SecurityError, “Class not found: #{params[:klass]}” if  
params[:klass].legal\_class?  
…  
rescue =\> e  
log.error("Cannot find class #{params[:klass]} #{params[:id]})  
raise  
end

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 6, 2007, 8:18am UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/4 "2007-05-06T08:18:05Z")

</div>

Sure, here’s an example using log, and one using exceptions:

Assuming there is a parameter klass, which is used as the class for  
lookup:

/controller/method/id?klass=Blog

def list  
begin  
raise SecurityError, “Class not found: #{params[:klass]}” if  
!params[:klass].legal\_class?  
…  
rescue =\> e  
log.error("Cannot find class #{params[:klass]} #{params[:id]})  
raise  
end

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 6, 2007, 6:42pm UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/5 "2007-05-06T18:42:56Z")

</div>

Really I’m concerned about the two lines:

raise SecurityError, “Class not found: #{params[:klass]}”  
log.error("Cannot find class #{params[:klass]} #{params[:id]})

where a user could pass code through the url parameters, and code  
injection occurs on the two message types.

I need to clean up my code, and then send an example. If you see any  
problems with the above, let me know.

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 6, 2007, 5:01pm UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/6 "2007-05-06T17:01:46Z")

</div>

Sorry I’m a little lost. Nothing in that snippet seems like code  
injection unless #legal\_class? is implemented insecurely. Or unless  
it’s hiding in the …

Care to reveal a bit more?

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 7, 2007, 5:11am UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/7 "2007-05-07T05:11:40Z")

</div>

There is nothing wrong with those two lines. Code injection is only  
an issue if you actually treat what the user gave you as code. In  
this case you’re just telling ruby to dump strings. Ruby doesn’t  
execute the contents in any way. There’s very little security  
concern.

If you’re unconvinced, then you can dump out the inspected versions of  
the strings. Most non-ASCII characters will show up as escaped  
octets:

log.error(“Cannot find class #{params[:klass].inspect}  
#{params[:id].inspect}”)

---

<div class="post-metadata">

**Author:** ![yottameter](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yottameter](https://www.ruby-forum.com/u/yottameter)\
**Post date:** [May 7, 2007, 6:07am UTC](https://www.ruby-forum.com/t/safety-of-raising-exception/103448/8 "2007-05-07T06:07:42Z")

</div>

Ah. So the reason SQL injection occurs  
in :conditions=\>“something=#{params[:something]}” because the SQL  
command is dependent on a string. I wasn’t clear on the distinction  
between the two evaluation contexts that are obviously safe, and the  
SQL injection example.

Thanks for the great help!