views:

48

answers:

2

I had a rare error in my Rails application. A CSS file was referring to non existing image files. And missing PNG file was somehow mapped to a controller action. Fortunately the action wasn't changing DB. This seems to be not OK that missing PNG can trigger controller action.

So should I disable mod_rails for static asset directories? However I've never heard this is required for Rails apps.

A: 

It is definitely a good idea, since if you allow any kind of image upload the target destination is usually the asset directory. Normally the user can quite easily upload a php or ruby file instead, so disabling all mod_evil_script for these directories is a good idea in general.

nasmorn
Since the image request is a get your application should never change state on this error anyways so you should be safe. Malicious intent is the bigger issue actually.
nasmorn
A: 

You should be serving static assets directly via Apache anyway, because it's faster. Let Rails do what it's designed to do which is handle dynamic requests.

John Topley
I think he is serving them from apache but since the directory is mod_rails enabled the missing image file was probably in the public directory itself and therefore mapped to a controller name. Or can you somehow bring rails to also take requests for image files?
nasmorn
Static assets are served directly via Apache. But when a file is missing then the request goes to Rails application server. It is behavior correct?
Greg Dan