CODEWITHSUNDEEP
rubysinatra
user1152226
user1152226

Reputation: 323

View routes in Sinatra

The following code snippet is how I am handling routes in my Sinatra application. All of my views are contained in my views/pages directory. These are just haml files that represent static html, with some javascript. Are there any negative implications to loading views in this manner? If the page does not exist, it throws a file not found error. I am worried this is somehow an attack vector. 

 error RuntimeError do
    status 500
    "A RuntimeError occured"
  end

  get '/:page' do
    begin
      haml "pages/#{params['page']}".to_sym
    rescue Errno::ENOENT
      status 404
      "404"
    end
  end

Upvotes: 0

Views: 343

Answers (2)

ian
ian

Reputation: 12251

Are there any negative implications to loading views in this manner?

Time would be one, it takes a lot longer to generate a page than to serve a static one. Resource use would be another for the same reason. Added complexity another. Reinventing the wheel would be another.

Why not just put static pages in the public directory? Or why not use a static site generator?

Pick the tool that fits your needs, and don't reinvent the wheel (especially when the framework has already provided you with that wheel!)

Upvotes: 0

evotopid
evotopid

Reputation: 5429

I'm not sure if this is a security concern here (I'm not that into all the details of Sinatra) but I tend to be paranoid when using user specified data like for example params['page'] in your example. As said I'm not sure if Sinatra sanitizes the content and would make this example impossible, but imagine it said something like ../db_connection.yml. So Sinatra would be told to load the haml file pages/../db_connection.yml which might actually exist and display it to the user showing them your database configuration.

If you don't have any weird symlinks in your pages directory it would probably be enough to replace all double occurences of a dot with something like .gsub(/\.+/, ".") of the passed string (or replace all dots if you don't need them in the name to be even more paranoid). I'm not sure if there are any multi-byte insecurities where someone could do something ugly with encodings though and it might be useless to do the replacing at all because the exploit would work nevertheless.

Edit: Short reading into the Sinatra manual yielded that

By the way, unless you disable the path traversal attack protection (see below), the request path might be modified before matching against your routes.

So it seams that it should be secure to just use the params value without any special filtering, you may however like to look into the documentation some more (especially the security sections). However I don't think it's too much of a security issue if it's possible to figure out if a file in your pages directory exists or not.

Upvotes: 1

Related Questions