# random exception driving me crazy: SecurityError (Insecure: can't modify array)

**URL:** <https://discuss.rubyonrails.org/t/random-exception-driving-me-crazy-securityerror-insecure-cant-modify-array/25562>\
**Category:** rubyonrails-talk\
**Created:** [February 28, 2008, 2:53am UTC](https://discuss.rubyonrails.org/t/random-exception-driving-me-crazy-securityerror-insecure-cant-modify-array/25562 "2008-02-28T02:53:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mike\_Garey](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@Mike\_Garey](https://discuss.rubyonrails.org/u/Mike_Garey)\
**Post date:** [February 28, 2008, 2:53am UTC](https://discuss.rubyonrails.org/t/random-exception-driving-me-crazy-securityerror-insecure-cant-modify-array/25562/1 "2008-02-28T02:53:48Z")

</div>

Hi all, I'm running into a very strange but incredibly annoying problem that I just can't seem to solve.

The exception is occurring from a seemingly innocuous line in my code, a simple 'logger.warn("some debug information")'. The backtrace follows:

SecurityError (Insecure: can't modify array) &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[RAILS\_ROOT]/vendor/rails/activesupport/lib/active\_support/buffered\_logger.rb:68:in `\<\<' &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[RAILS_ROOT]/vendor/rails/activesupport/lib/active_support/buffered_logger.rb:68:in `add' &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[RAILS\_ROOT]/vendor/rails/activesupport/lib/active\_support/buffered\_logger.rb:75:in `warn' &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[RAILS_ROOT]/app/models/order.rb:244:in `process\_with\_active\_merchant' &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[RAILS\_ROOT]/vendor/plugins/acts\_as\_state\_machine/lib/acts\_as\_state\_machine.rb:162:in `call'

The line in my model class, order.rb, that causes the exception is the following:

logger.warn("Processing order with payment gateway")

Now, I could probably just remove the offending log line to fix the problem, but this bothers me, since it may point to a larger problem that I'm not aware of, which I 'd rather not ignore. What makes this problem even more difficult to solve is that it doesn't happen consistently and is very difficult to reproduce. It seems to only happen after my mongrel instances have been running for a few hours and are each using over 100 megs of memory (maybe there's some memory leak or thrashing or something that's causing this to happen). I've googled for the error and can't seem to find much information, nor why it would be thrown from a Rails standard library file. I've tested this both on edge Rails 8117 and also a more recent edge Rails 8927 with no difference.

When I restart my mongrel cluster, everything works fine, orders are processed, no exceptions are thrown. But after a few hours, maybe a day of running on the production site, I start getting the 'SecurityError (Insecure: can't modify array)' message as described above (it happens at the same place each time)

My next guess is that it could possibly have something to do with using acts\_as\_state\_machine, which I'm going to remove and see if it changes anything.

If anyone has any suggestions or advice, please let me know. I've been trying to fix this for over a week and haven't made any progress.

For those interested, the following is the code that leads up to the error. It's pretty simple stuff, we attempt to save the order, and in an after\_create method in the Order model, we charge the user's credit card (using a transition from acts\_as\_state\_machine). If we can charge it successfully, we save the order, otherwise, we raise an exception and display an error message to the user.

orders\_controller.rb

def create &nbsp;&nbsp;# populate order details (ommitted for brevity)

&nbsp;&nbsp;begin &nbsp;&nbsp;&nbsp;&nbsp;if @order.save &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# display successful message, redirect somewhere &nbsp;&nbsp;&nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;# user probably forgot to enter some info, display error message &nbsp;&nbsp;&nbsp;&nbsp;end &nbsp;&nbsp;rescue &nbsp;&nbsp;&nbsp;&nbsp;# if we get here, then an exception must have been raised while &nbsp;&nbsp;&nbsp;&nbsp;# processing the credit card with active merchant &nbsp;&nbsp;&nbsp;&nbsp;logger.warn("Error occurred while attempting to save order") &nbsp;&nbsp;&nbsp;&nbsp;# render some page with warning message &nbsp;&nbsp;end end

order.rb

# we use acts\_as\_state\_machine to provide order state acts\_as\_state\_machine :initial =\> :pending, :column =\> :status

# order has been created, but no payment has been received state :pending

# process the payment with active\_merchant state :processing\_payment, :after =\> :process\_with\_active\_merchant

# charge the user's credit card event :process\_payment do &nbsp;&nbsp;transitions :from =\> :pending, :to =\> :processing\_payment end

def after\_create &nbsp;&nbsp;# the following method raises an exception if we fail to charge the users &nbsp;&nbsp;# credit card, prevents the order from being saved. &nbsp;&nbsp;self.process\_payment!

&nbsp;&nbsp;# some other post-processing tasks &nbsp;&nbsp;self.send\_order\_to\_distributor!

&nbsp;&nbsp;self.complete! end

def process\_with\_active\_merchant &nbsp;&nbsp;# the following line causes a SecurityError (Insecure: can't modify array) exception &nbsp;&nbsp;logger.warn("Processing order with payment gateway")

&nbsp;&nbsp;gateway = ActiveMerchant::Billing::AuthorizedNetGateway.new({:login =\> API\_LOGIN\_ID, :password =\> TRANSACTION\_KEY})

&nbsp;&nbsp;response = gateway.purchase(self.total\_price, @credit\_card, options)

&nbsp;&nbsp;if response.success? &nbsp;&nbsp;&nbsp;&nbsp;logger.warn("Successfully charged credit card with #{self.total\_price}: #{response.message}") &nbsp;&nbsp;&nbsp;&nbsp;self.transaction\_id = response.authorization &nbsp;&nbsp;&nbsp;&nbsp;self.save &nbsp;&nbsp;else &nbsp;&nbsp;&nbsp;&nbsp;logger.warn("Failed to charge credit card") &nbsp;&nbsp;&nbsp;&nbsp;raise OrderFailedException.new(response.params['response\_reason\_code']), response.message &nbsp;&nbsp;end

end

Thanks,

Mike

---

<div class="post-metadata">

**Author:** ![11175](https://avatars.discourse-cdn.com/v4/letter/1/8edcca/32.png) [@11175](https://discuss.rubyonrails.org/u/11175)\
**Post date:** [July 21, 2008, 3:22pm UTC](https://discuss.rubyonrails.org/t/random-exception-driving-me-crazy-securityerror-insecure-cant-modify-array/25562/2 "2008-07-21T15:22:28Z")

</div>

Hey Mike,

Any update on this? I'm seeing something similar as well with acts\_as\_state\_machine

?

Mike Garey wrote:

---

<div class="post-metadata">

**Author:** ![Mike\_Garey](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@Mike\_Garey](https://discuss.rubyonrails.org/u/Mike_Garey)\
**Post date:** [January 24, 2009, 11:17am UTC](https://discuss.rubyonrails.org/t/random-exception-driving-me-crazy-securityerror-insecure-cant-modify-array/25562/3 "2009-01-24T11:17:32Z")

</div>

Rehashing an old message. I found a solution to this a while ago but never responded to my original message. Well, better late than never! Hopefully this will help someone in the future from wasting the amount of time that I did.

The problem turned out to be a bug with using self.method(action).call in acts\_as\_state\_machine. To fix it, I removed self.method(action).call from run\_transition\_action(action) method in acts\_as\_state\_machine.rb, and replaced it with self.send(action), since self.method(action) was causing the SecurityError (Insecure: can't modify array).

Here's two other links from people who have run into the same problem in the past:

[http://cmms.norfello.com/cmms/ticket/445](http://cmms.norfello.com/cmms/ticket/445)[http://code.google.com/p/dry-scaffold/source/browse/dry\_scaffold/CHANGELOG](http://code.google.com/p/dry-scaffold/source/browse/dry_scaffold/CHANGELOG)

This issue existed in revision 66 of the acts\_as\_state\_machine from here:

[http://elitists.textdriven.com/svn/plugins/acts\_as\_state\_machine/trunk/lib/acts\_as\_state\_machine.rb](http://elitists.textdriven.com/svn/plugins/acts_as_state_machine/trunk/lib/acts_as_state_machine.rb)

I'm not sure if it still exists in the github version.

Mike