Suspicious ^91% gem 1,572,160 installs Download

route_downcaser 0.2.2

Legitimate Rails routing gem

“This gem hooks into the Rack middleware of Rails. This way all paths are downcased before dispatching to Rails' routing mechanism. Querystr…”

README basename (markdown/plain text)References Rails signing key or verifier

SHA-2569324119095c056927158a0e0f578212bd6ae17107392b56911dfbc8ca0c6500e

URLhttps://rubygems.org/downloads/route_downcaser-0.2.2.gem

MaleculeO₂(AsLa)H₅(Cm₄CrDb₂FPo)Md₃(InPa₂Pt)

Evidence

Ruby defines methods dynamically configuration.rb · lines 16–26

⋯4 lines
20
21  def define_class_method(name, &block)
22    (class << self; self; end).instance_eval do
23      define_method name, &block
24    end
25  end
26end

Source embeds a long hexadecimal string secret_token.rb · lines 5–8

5:2…  Make sure the secret is at least 30 characters and all random,
6# no regular words or you'll be exposed to dictionary attacks.
7Dummy::Application.config.secret_token = '74c0353f079452c53b67b6ba76d51f464857e09f98e220e35971deed9c73d3ea2d31ce655b3ffffda15df30605606a47dc32a519618557d9b0b7fd1f72c3d08a'
8Dummy::Application.config.secret_key_base = 'theyretakingthehobbitstoisengard'

Names the CGI REQUEST_URI variable downcase_route_middleware.rb · lines 4–16

⋯4 lines
    @env = env
9
    if env['REQUEST_URI']
      if RouteDowncaser.redirect == true
        if path != path.downcase
          return [301, {'Location' => downcased_uri, 'Content-Type' => 'text/html'}, []]
        end
      else
        …

Contains a hardcoded remote HTTP(S) URL README.rdoc · lines 5–13

5:131…  Querystring parameters are not changed in any way.
6
7{<img src="https://travis-ci.org/carstengehling/route_downcaser.png" />}[https://travis-ci.org/carstengehling/route_downcaser]
8
9== Requirements
10
11This gem has been tested with Rails 3.+, Rails 4.0, and Sinatra
12
13If you want this functionality in a Rails 2.x application, please refer to {this blog post}[http://gehling.dk/2010/02/how-to-make-rails-routing-case-insen …

References a loopback HTTP URL README.rdoc · lines 23–31

23:86… lf into the Rack middleware call stack.
24
25If you have a controller named app/controllers/foo_controller.rb and the action index, you can now call it with:
26
27      http://localhost:3000/foo
28      http://localhost:3000/Foo
29      http://localhost:3000/FOO
30      http://localhost:3000/foo/index
31      http://loc …

No evidence locations were recorded for this file. Raw result