From: marcandre-ruby-core@...
Date: 2021-03-20T17:11:02+00:00
Subject: [ruby-core:102962] [Ruby master Bug#17738] Ruby can still freeze ENV

Issue #17738 has been updated by marcandre (Marc-Andre Lafortune).


I believe so, yes.

----------------------------------------
Bug #17738: Ruby can still freeze ENV
https://bugs.ruby-lang.org/issues/17738#change-91026

* Author: kachick (Kenichi Kamiya)
* Status: Open
* Priority: Normal
* ruby -v: ruby 3.0.0p0 (2020-12-25 revision 95aff21468) [x86_64-darwin20]
* Backport: 2.5: UNKNOWN, 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN
----------------------------------------
After https://bugs.ruby-lang.org/issues/15920 and https://github.com/ruby/ruby/commit/f53d7e4bfd604be6f8131c5460c29f4af16da117, `ENV.freeze` raises TypeError.
But we can still freeze ENV as below.

```ruby
Kernel.instance_method(:freeze).bind(ENV).call()
p ENV.frozen? #=> true
```

This loophole should be ignored?



-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>