rack-webconsole

It'd be one thing if this gem caused any arbitrary query string to be executed as ruby code That's pretty much the exact designed intent of the software. Read the Repl code, specifically, Repl#call at line 59 or so. https://github.com/codegram/rack-webconsole/blob/master/lib/... You'll note the code has recently been enhanced with check_legitimate, which was designed to patch the issue I raised on this thread (and via email). I am going to very carefully avoid commenting about whether check_legitimate actually works as designed. My main worry is that pronouncing it done well would make me professionally responsible when it gets cracked, and committing to endless rounds of "Actually, that won't really work" throws good hours after bad in pursuit of securing a bad idea which is architecturally insecurable. Do not allow your web applicati