LeckyLao's Blog

Ruby Fanster



No ActionCable & Pusher

No ActionCable & Pusher

WebSocket in Ruby and on Rails

Lecky Lao(@leckylao)
RORO 11-08-2015


Regex in Ruby

# encoding: utf-8

Regex In Ruby – Capture Groups

Lecky Lao(@leckylao)

RORO 09-06-2015

Mongo BSON Injection: Ruby Regexps Strike Again

Jun 4, 2015 • Egor Homakov (@homakov)

Mongoid is an ODM(Object Document Mapper) Framework
for MongoDB written in Ruby

Mongoid uses more low-level adapter Moped which uses BSON-ruby

the vulnerability is in legal? method of BSON::ObjectId

  # /\nhi\n/ =~ /hi$/
  # /\nhi\n/ =~ /hi\Z/
  # /\nhi\n/ =~ /hi\z/

  # Vulnerable
  def legal?(string)
    # March 31 2013 to Apr 7 2013
    /\A\h{24}\Z/ === string.to_s
    # currently it thinks Mongo is down and pings it 39 more times with intervals.
    # In other words it keeps the worker busy for 5 seconds and makes x40 requests to Mongo DB
    # One way or another, it is Denial of Service.

    # Apr 7 2013 till now
    string.to_s =~ /^[0-9a-f]{24}$/i ? true : false
    # he attacker can send any data to the socket with something like
    # _id=Any binary data\naaaaaaaaaaaaaaaaaaaaaaaa\nAny binary data

  # Patch
  def ((defined?(Moped::BSON) ? Moped::BSON : BSON)::ObjectId).legal?(s)
    /\A\h{24}\z/ === s.to_s

—-Capturing Groups—-

    # What's the difference?

    /sat (in)/.match("The cat sat in the hat")

    "The cat sat in the hat" =~ /sat (in)/

The difference is

The operator =~ returns the index

of the first match (nil if no match)

and stores the MatchData

in the global variable $~

The method match returns

the MatchData itself (again, nil if no match)

Grouping with reference

    # What's the difference?


    "$3.67" =~ /\$(?\d+)\.(?\d+)/

    /\$(?\d+)\.(?\d+)/ =~ "$3.67"

The difference is

When named capture groups are used with a literal regexp

on the left-hand side of an expression and the =~ operator,

the captured text is also assigned to local variables

with corresponding names.


    # Is this correct?

"The cat sat in the hat".gsub(/(.*)cat(.*)/, "#{$1}black dog#{$2}")
"The cat sat in the hat".gsub(/(.*)cat(.*)/, "\1black dog\2")

"The cat sat in the hat".gsub(/(.*)cat(.*)/, '\1black dog\2')

"The cat sat in the hat".gsub(/(?<prefix>.*)cat(.*)/, '\k<prefix>black dog\2')

"The cat sat in the hat".gsub(/(?<prefix>.*)cat(?<suffix>.*)/, '\k<prefix>black dog\k<suffix>')

$1 and $2 only store after the execution, therefore
and use \\1 and \\2 instead

use '' instead of "" when using regex

A regexp can't use named backreferences
and numbered backreferences simultaneously.

That's all, thanks!

slide: – examples/regex_in_ruby.rb

slides made using tkn("

jRuby SWT

Lecky Lao – jRuby SWT from Dan Draper on Vimeo.

How to run whenever with rvm integration

Simply overwrite the job_type to include the rvm version you want

job_type :rake, "source /etc/profile.d/ &amp;&amp; rvm use ruby-2.0.0-p247 &amp;&amp; cd :path &amp;&amp; :environment_variable=:environment bundle exec rake :task --silent :output"

every, :at =&gt; '8:00 am' do
  rake "users:activities"

Rails Complex Order Query

Today gonna talk about Rails Complex Query for ordering. Here’s a simple query order by status

@events = @events.order("status DESC")

But what happen if you want to make the query to order the status in a specific sequence. Here’s the example:

@events = @events.order("
WHEN events.status = 'NEW' THEN 0
WHEN events.status = 'OPEN' THEN 1
WHEN events.status = 'UPDATED' THEN 2
WHEN events.status = 'WAITING' THEN 3
WHEN events.status = 'ABANDONED' THEN 4

Happy Hacking, Enjoy! 🙂

Create a free website or blog at

Up ↑