Begin and Rescue block exception handling

Question

I have little experience in rails exception handling. I have this snippet

def update
  @game = Game.find(params[:id])
  begin
    params[:game][:tier] = eval(params[:game][:tier]) 
  rescue 
    @game.errors.add(:tier, "Please make sure the correct format for tier, example [100, 1000, 10000]")
  end
#.... more code
end

In case params[:game][:tier] = "[100,200]" everything is perfect. In case of error case of ruby syntax like params[:game][:tier] = "[100,200] abc" it catch the error however the application just crush.

How can I handle exception with 'eval()' such that it won't crush the app? Why begin and rescue does not work in this case? Appreciate any help for ruby enlightenment thanks :)

Kyle · Accepted Answer · 2013-04-24T15:25:39.173

4

What if params[:game][:tier] was "[100,200]; system('rm -rf /')"?

Since the incoming data is expected to be an array, I would not use eval but JSON.parse instead:

> JSON.parse("[100,200]")
 => [100, 200]
> JSON.parse("[100,200] abc")
JSON::ParserError: 746: unexpected token at 'abc'...

Then rescue from only a JSON::ParserError exception

rescue JSON::ParserError => e

This will also solve the rescue not catching the exception problem you're having.

edited Apr 24 '13 at 15:25

answered Apr 24 '13 at 15:19

Kyle

21,978
2
60
61

1

Wow, this is dangerous injection. Lot of thanks, and JSON.parse does work really well. :D – sovanlandy Apr 24 '13 at 15:29
3

And once again proof that (in most cases) `eval` is evil and can be replaced with something way better. – Patrick Oscity Apr 24 '13 at 15:31

score 1 · Answer 2 · edited May 23 '17 at 11:51

1

duplicate of this

however you should rescue in this way

def update
  @game = Game.find(params[:id])
  begin
    params[:game][:tier] = eval(params[:game][:tier]) 
  rescue Exception => e
    @game.errors.add(:tier, "Please make sure the correct format for tier, example [100, 1000, 10000]")
  end
#.... more code

end

in order to make it work

edited May 23 '17 at 11:51

Community

1
1

answered Apr 24 '13 at 15:19

Alive Developer

1,022
1
13
25

5

never, ever rescue Exception – bhaity Feb 03 '15 at 00:13
Agree, rescue `StandardError` instead. Source: https://robots.thoughtbot.com/rescue-standarderror-not-exception – Jack Collins Sep 06 '16 at 20:26

Begin and Rescue block exception handling

2 Answers2