From 5a79942d06e1b1c1984c2f4a5bdd75c849cedcfc Mon Sep 17 00:00:00 2001 From: Tom Levy Date: Sat, 23 Dec 2023 22:31:07 +1300 Subject: [PATCH 1/3] Restrict permissions on config/secret_key_base.*.txt The file should only be readable by the owner. --- config/initializers/secret_token.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/config/initializers/secret_token.rb b/config/initializers/secret_token.rb index 7b86afb2..ba9ad020 100644 --- a/config/initializers/secret_token.rb +++ b/config/initializers/secret_token.rb @@ -26,9 +26,9 @@ # Randomly generate a secret and store it in config/secret_key_base.#{env}.txt # Code inspired by Rails.application.generate_local_secret # (https://github.com/rails/rails/blob/v7.1.2/railties/lib/rails/application.rb#L665) - file = Rails.root.join("config/secret_key_base.#{Rails.env}.txt") - if !File.exist?(file) - File.binwrite(file, SecureRandom.hex(64)) + filename = Rails.root.join("config/secret_key_base.#{Rails.env}.txt") + if !File.exist?(filename) + File.open(filename, "wb", 0600) { |f| f.write(SecureRandom.hex(64)) } end - NZTrain::Application.config.secret_key_base = File.binread(file).strip + NZTrain::Application.config.secret_key_base = File.binread(filename).strip end From c46649a6aa73ed8cbc402c1720d84b09e14155ea Mon Sep 17 00:00:00 2001 From: Tom Levy Date: Sat, 23 Dec 2023 23:23:47 +1300 Subject: [PATCH 2/3] Apply formatting changes requested by standardrb --- config/initializers/secret_token.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config/initializers/secret_token.rb b/config/initializers/secret_token.rb index ba9ad020..f3b172e4 100644 --- a/config/initializers/secret_token.rb +++ b/config/initializers/secret_token.rb @@ -27,8 +27,8 @@ # Code inspired by Rails.application.generate_local_secret # (https://github.com/rails/rails/blob/v7.1.2/railties/lib/rails/application.rb#L665) filename = Rails.root.join("config/secret_key_base.#{Rails.env}.txt") - if !File.exist?(filename) - File.open(filename, "wb", 0600) { |f| f.write(SecureRandom.hex(64)) } + unless File.exist?(filename) + File.open(filename, "wb", 0o600) { |f| f.write(SecureRandom.hex(64)) } end NZTrain::Application.config.secret_key_base = File.binread(filename).strip end From 7c4e6c5318658703997a85720ebc8f7e77e7ce90 Mon Sep 17 00:00:00 2001 From: Tom Levy Date: Sun, 24 Dec 2023 01:11:54 +1300 Subject: [PATCH 3/3] Revert a standardrb formatting change (if => unless) The change was requested by standard 0.2.5, but standard 1.32.1 doesn't complain about it and I think I prefer the original version. --- config/initializers/secret_token.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/secret_token.rb b/config/initializers/secret_token.rb index f3b172e4..da6b0f40 100644 --- a/config/initializers/secret_token.rb +++ b/config/initializers/secret_token.rb @@ -27,7 +27,7 @@ # Code inspired by Rails.application.generate_local_secret # (https://github.com/rails/rails/blob/v7.1.2/railties/lib/rails/application.rb#L665) filename = Rails.root.join("config/secret_key_base.#{Rails.env}.txt") - unless File.exist?(filename) + if !File.exist?(filename) File.open(filename, "wb", 0o600) { |f| f.write(SecureRandom.hex(64)) } end NZTrain::Application.config.secret_key_base = File.binread(filename).strip