Rails security resources

Resources

Rails security guide: https://guides.rubyonrails.org/security.html

Zen rails security checklist: https://github.com/brunofacca/zen-rails-security-checklist

OWASP ruby on rails cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Ruby_on_Rails_Cheat_Sheet.html

Static code analysis/audit tools

Bundle audit: https://github.com/rubysec/bundler-audit

Brakeman: https://github.com/presidentbeef/brakeman

Fixing 'find_spec_for_exe': can't find gem bundler

When you run into following error:

'find_spec_for_exe': can't find gem bundler (>= 0.a) with executable bundle (Gem::GemNotFoundException)

It might be that your gem version is too old and does not fit bundler ~> 2.

Try updating gem:

gem update --system '2.7.9'

Capistrano and bundle config

When you use capistrano and you need a custom bundler config in your Rails app, you have the problem, that it gets lost after each update.

The solution to this problem is to move the .bundle folder in your rails app, to the shared folder in your capistrano environment. Then you tell capistrano to link the .bundle to the shared folder after each update.

• First, move your Rails.root/.bundle to ../../shared/.bundle
• Add a rake task to Rails.root/config/deploy.rb:

namespace(:bundle) do
  desc "Symlinks your machine specific bundle to your rails app"
  task :symlink, :roles => :app do
    run <<-CMD
      ln -nfs #{shared_path}/.bundle #{release_path}/.bundle
    CMD
  end
end

• tell capistrano to invoke the bundle:symlink task after symlinking your freshly deployed realase. In your Rails.root/config/deploy.rb:

after "deploy:symlink", "bundle:symlink"