Problem We recently upgraded one of our apps to Rails 6, which required upgrading Brakeman to 5.x. Brakeman promptly threw this warning: Use of unsafe cookie serialization strategy `:marshal` might lead to remote code execution My understanding is that Marshal deserializes complex objects by effectively evaling them as arbitrary Ruby code…

When you run rails app:update on a Rails 5.0 app, it creates a file with 2 new default configuration settings. Here’s what they do and how to safely uncomment them. This article assumes your application is on the 5.0 defaults. You can verify this by checking that load_defaults 5.0is …

When you run rails app:update on a Rails 5.1 app, it creates a file with 7 new default configuration settings. Here’s what they do and how to safely uncomment them. This article assumes your application is on the 5.1 defaults. You can verify this by checking that load_defaults 5.1is …

When you run rails app:update on a Rails 6.0 app, it creates a file with 16 new default configuration settings. Here’s what they do and how you should use them. This article assumes your application is on the 6.0 defaults. You can verify this by checking that load_defaults 6.0is present…

What this ain’t. this ain’t the current scope. this ain’t a pointer to the current function. These are popular misconceptions. What this is When a function is invoked, JavaScript determines what this will be inside of that function. To figure that out, look at where the function was invoked. …

This is a walkthrough of the nine default flags in new_framework_defaults_6_0.rb generated by rails app:update. At the end of this article you’ll feel confident in deleting that file and adding load_defaults 6.0 to your application.rb. This article assumes your application is on the 5.2 defaults. You can verify this be…

Long forms with lots of fields can be intimidating to users. A better conversion rate can be achieved by breaking fields into separate “steps” that are presented to the user one-at-a-time. These multi-step forms are a common requirement in web development. There are two typical implementations: Break each step into…