{"action":"closed","issue":{"url":"https://api.github.com/repos/rails/rails/issues/21463","labels_url":"https://api.github.com/repos/rails/rails/issues/21463/labels{/name}","comments_url":"https://api.github.com/repos/rails/rails/issues/21463/comments","events_url":"https://api.github.com/repos/rails/rails/issues/21463/events","html_url":"https://github.com/rails/rails/issues/21463","id":104441567,"number":21463,"title":"Application fails to start when `SECRET_KEY_BASE` is a String containing only digits","user":{"login":"jperville","id":834791,"avatar_url":"https://avatars.githubusercontent.com/u/834791?v=3","gravatar_id":"","url":"https://api.github.com/users/jperville","html_url":"https://github.com/jperville","followers_url":"https://api.github.com/users/jperville/followers","following_url":"https://api.github.com/users/jperville/following{/other_user}","gists_url":"https://api.github.com/users/jperville/gists{/gist_id}","starred_url":"https://api.github.com/users/jperville/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jperville/subscriptions","organizations_url":"https://api.github.com/users/jperville/orgs","repos_url":"https://api.github.com/users/jperville/repos","events_url":"https://api.github.com/users/jperville/events{/privacy}","received_events_url":"https://api.github.com/users/jperville/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-02T09:47:09Z","updated_at":"2015-10-05T14:22:08Z","closed_at":"2015-10-05T14:22:08Z","body":"I have a rails 4.2.3 applications which I configured with a `ENV['SECRET_KEY_BASE'] = '1' * 128` (for demo purpose, not for production). This `SECRET_KEY_BASE` is valid (it is a 128 character long string), even if it somewhat lacks randomness.\r\n\r\nWhen I boot my application, it fails with the following stacktrace:\r\n\r\n```\r\n/home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/key_generator.rb:21:in `pbkdf2_hmac_sha1': no implicit conversion of Bignum into String (TypeError)\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/key_generator.rb:21:in `generate_key'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/key_generator.rb:38:in `generate_key'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/application.rb:206:in `message_verifier'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/globalid-0.3.6/lib/global_id/railtie.rb:25:in `block (2 levels) in <class:Railtie>'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/lazy_load_hooks.rb:36:in `call'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/lazy_load_hooks.rb:36:in `execute_hook'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/lazy_load_hooks.rb:45:in `block in run_load_hooks'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/lazy_load_hooks.rb:44:in `each'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/activesupport-4.2.3/lib/active_support/lazy_load_hooks.rb:44:in `run_load_hooks'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/application/finisher.rb:62:in `block in <module:Finisher>'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/initializable.rb:30:in `instance_exec'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/initializable.rb:30:in `run'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/initializable.rb:55:in `block in run_initializers'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:226:in `block in tsort_each'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:348:in `block (2 levels) in each_strongly_connected_component'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:427:in `each_strongly_connected_component_from'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:347:in `block in each_strongly_connected_component'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:345:in `each'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:345:in `call'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:345:in `each_strongly_connected_component'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:224:in `tsort_each'\r\n\tfrom /usr/lib/ruby/2.1.0/tsort.rb:205:in `tsort_each'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/initializable.rb:54:in `run_initializers'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/application.rb:352:in `initialize!'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/railtie.rb:194:in `public_send'\r\n\tfrom /home/app/current/vendor/bundle/ruby/2.1.0/gems/railties-4.2.3/lib/rails/railtie.rb:194:in `method_missing'\r\n\tfrom /home/app/current/config/environment.rb:5:in `<top (required)>'\r\n\tfrom bin/worker:3:in `require_relative'\r\n\tfrom bin/worker:3:in `<main>'\r\n```\r\n\r\nThe reason of the bug is probably that:\r\n * the `SECRET_KEY_BASE` is actually used in `config/secrets.yaml` using ERB interpolation\r\n * YAML implicitly casts the values to the most likely type: my SECRET_KEY_BASE containing only `1`s is cast into a Bignum instance instead of remaining a String as expected\r\n * at some point the value (with the incorrect type) is used by code which expects a String instance and we get the above stacktrace.\r\n\r\nIf I were familiar with the rails code base I would write fix the issue like this:\r\n\r\n```diff\r\ndiff --git a/lib/active_support/key_generator.rb b/lib/active_support/key_generator.rb\r\nindex 51d2da3..8a4a132 100644\r\n--- a/lib/active_support/key_generator.rb\r\n+++ b/lib/active_support/key_generator.rb\r\n@@ -18,7 +18,7 @@ module ActiveSupport\r\n     # to be compatible with the default settings of ActiveSupport::MessageVerifier.\r\n     # i.e. OpenSSL::Digest::SHA1#block_length\r\n     def generate_key(salt, key_size=64)\r\n-      OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)\r\n+      OpenSSL::PKCS5.pbkdf2_hmac_sha1(String(@secret), salt, @iterations, key_size)\r\n     end\r\n   end\r\n \r\n```\r\n\r\nThis issue is unlikely to happen in the real world but still theoretically possible."}}