Comments on: HAML Caching CGI http://blog.kesor.net/2007/07/30/haml-caching-cgi/ Making technology about computers, and computers about usability. Mon, 30 Aug 2010 06:59:47 -0700 http://wordpress.org/?v=2.8.5 hourly 1 By: Charlie Smurthwaite http://blog.kesor.net/2007/07/30/haml-caching-cgi/comment-page-1/#comment-168 Charlie Smurthwaite Mon, 30 Aug 2010 06:59:47 +0000 http://blog.kesor.net/2007/07/30/haml-caching-cgi/#comment-168 I had a similar attept at rendering HAML from within Apache. I was able to do it using a persistent Ruby instance using mod_ruby. I realize this is an old post, but thought you may be interested to see my approach: http://atechmedia.com/blog/mini-projects/static-sites-with-haml-and-apache I had a similar attept at rendering HAML from within Apache. I was able to do it using a persistent Ruby instance using mod_ruby. I realize this is an old post, but thought you may be interested to see my approach: http://atechmedia.com/blog/mini-projects/static-sites-with-haml-and-apache

]]> By: Mike Zillion http://blog.kesor.net/2007/07/30/haml-caching-cgi/comment-page-1/#comment-6 Mike Zillion Sun, 12 Aug 2007 02:01:06 +0000 http://blog.kesor.net/2007/07/30/haml-caching-cgi/#comment-6 I appreciate the effort, and the concerns that were raised about the security. I would still love to see something like this work. I've been completely spoiled by HAML. I appreciate the effort, and the concerns that were raised about the security. I would still love to see something like this work. I’ve been completely spoiled by HAML.

]]> By: Roman Shterenzon http://blog.kesor.net/2007/07/30/haml-caching-cgi/comment-page-1/#comment-5 Roman Shterenzon Mon, 06 Aug 2007 21:53:35 +0000 http://blog.kesor.net/2007/07/30/haml-caching-cgi/#comment-5 Line 11 has a serious security flaw - directory traversal, which in line 29 can lead to disaster. The "output" is an unknown object on line 20, unless there's a cached file already. Either define it or use defined?(output) I'd also remove the Pragma, Cache-control and Expires headers, keeping only the Last-Modified. It makes sense, think about it. Line 11 has a serious security flaw – directory traversal, which in line 29 can lead to disaster.
The “output” is an unknown object on line 20, unless there’s a cached file already. Either define it or use defined?(output)
I’d also remove the Pragma, Cache-control and Expires headers, keeping only the Last-Modified. It makes sense, think about it.

]]> By: Woody Peterson http://blog.kesor.net/2007/07/30/haml-caching-cgi/comment-page-1/#comment-4 Woody Peterson Wed, 01 Aug 2007 11:40:14 +0000 http://blog.kesor.net/2007/07/30/haml-caching-cgi/#comment-4 I had a hard time getting this to work, so I thought I would share some bits of wisdom I gained. First of all, I had a consistent but cryptic host of error messages that all went away the moment I changed haml_cache_cgi.rb to haml_cache_cgi.cgi (well, eventually haml_cache.cgi, 'cuz the former is repetitive). Note that permissions were always correct, i.e. this was not a permissions issue that I accidentally solved at the same time (they produce similar error behaviors). Second, in the script, I needed to either prefix haml_file with ../../, or just put haml_cache.cgi in the root (read: web root, etc) directory. I did the latter, as well as making it a hidden file for later convenience (.haml_cache.cgi). Then, another problem was that ARGV[0] is meant to get at the first argument passed to haml_cache.cgi. Thus, I assumed, say, index.haml would make a call along the lines of ">haml_cache.cgi index.haml". What I found was that haml_cache.cgi was being passed no argument; rather, it seems (on my environment at least) that the requested file is meant to be accessed via ENV['REQUEST_URI'] (see http://www.ruby-doc.org/core/classes/CGI.html for a full list of cgi-specific environment variables). Thus, I changed ARGV[0] to ENV['REQUEST_URI'], and all was almost good. Actually, ENV['REQUEST_URI'] gives a preceding slash (ex. "/index.html"), but a little bit of gsub-ing fixed that like so: ENV['REQUEST_URI'].gsub(/^\//, ''). To sum up, then, your lines 3 and 4 are for me: exit if ENV['REQUEST_URI'].nil? haml_file = ENV['REQUEST_URI'].gsub(/^\//,'') exit unless File.exists?(haml_file) (Note to readers: line 8 would be gone too). As a final note, I'm hosting on dreamhost (yeah, I know... I've actually become a dreamhost deployment ninja ('cuz you have to), so it's not a bad staging environment). For those who don't know dreamhost, they're dirt cheap shared hosting. Anyways, like most shared hosts, you can't install gems yourself except locally, so I had to also change "require 'haml'" to "require '/home/username/.gems/gems/haml-1.7.0/lib/haml'". Well, that about sums it up. I spent the better part of my (supposed) work day getting this working, mostly due to lack of understanding (read: when cut'n'paste goes wrong). Hope it helps! I had a hard time getting this to work, so I thought I would share some bits of wisdom I gained.

First of all, I had a consistent but cryptic host of error messages that all went away the moment I changed haml_cache_cgi.rb to haml_cache_cgi.cgi (well, eventually haml_cache.cgi, ‘cuz the former is repetitive). Note that permissions were always correct, i.e. this was not a permissions issue that I accidentally solved at the same time (they produce similar error behaviors).

Second, in the script, I needed to either prefix haml_file with ../../, or just put haml_cache.cgi in the root (read: web root, etc) directory. I did the latter, as well as making it a hidden file for later convenience (.haml_cache.cgi).

Then, another problem was that ARGV[0] is meant to get at the first argument passed to haml_cache.cgi. Thus, I assumed, say, index.haml would make a call along the lines of “>haml_cache.cgi index.haml”. What I found was that haml_cache.cgi was being passed no argument; rather, it seems (on my environment at least) that the requested file is meant to be accessed via ENV['REQUEST_URI'] (see http://www.ruby-doc.org/core/classes/CGI.html for a full list of cgi-specific environment variables). Thus, I changed ARGV[0] to ENV['REQUEST_URI'], and all was almost good. Actually, ENV['REQUEST_URI'] gives a preceding slash (ex. “/index.html”), but a little bit of gsub-ing fixed that like so: ENV['REQUEST_URI'].gsub(/^\//, ”). To sum up, then, your lines 3 and 4 are for me:

exit if ENV['REQUEST_URI'].nil?
haml_file = ENV['REQUEST_URI'].gsub(/^\//,”)
exit unless File.exists?(haml_file)

(Note to readers: line 8 would be gone too).

As a final note, I’m hosting on dreamhost (yeah, I know… I’ve actually become a dreamhost deployment ninja (’cuz you have to), so it’s not a bad staging environment). For those who don’t know dreamhost, they’re dirt cheap shared hosting. Anyways, like most shared hosts, you can’t install gems yourself except locally, so I had to also change “require ‘haml’” to “require ‘/home/username/.gems/gems/haml-1.7.0/lib/haml’”.

Well, that about sums it up. I spent the better part of my (supposed) work day getting this working, mostly due to lack of understanding (read: when cut’n'paste goes wrong). Hope it helps!

]]>