From: "byroot (Jean Boussier)" <noreply@...>
Date: 2021-09-17T14:19:17+00:00
Subject: [ruby-core:105327] [Ruby master Bug#18141] Marshal load with proc yield strings before they are fully initialized

Issue #18141 has been updated by byroot (Jean Boussier).


So while working on https://bugs.ruby-lang.org/issues/18148, I discovered that many other types of objects are impacted.


Just a few examples:
```ruby
def round_trip(obj, proc = ->(o) { o.freeze })
  Marshal.load(Marshal.dump(obj), proc)
end

h = {}
h.instance_variable_set(:@foo, 42) #<FrozenError: can't modify frozen Hash>
round_trip(h) rescue p $!

a = []
a.instance_variable_set(:@foo, 42) #<FrozenError: can't modify frozen Array>
round_trip(a) rescue p $!
```

Also, probably by design, but since you can replace the oject by what the proc returns:
```ruby
a = {}
a.instance_variable_set(:@foo, 42)
round_trip(a, proc { 24 }) rescue p $! #<FrozenError: can't modify frozen Integer>
```


I fixed most cases in https://github.com/ruby/ruby/pull/4859, which is my current attempt at implementing https://bugs.ruby-lang.org/issues/18148, but since I just noticed this was marked for backport, I might need to split the bug fix from the new feature. No?

----------------------------------------
Bug #18141: Marshal load with proc yield strings before they are fully initialized 
https://bugs.ruby-lang.org/issues/18141#change-93742

* Author: byroot (Jean Boussier)
* Status: Closed
* Priority: Normal
* Backport: 2.6: REQUIRED, 2.7: REQUIRED, 3.0: REQUIRED
----------------------------------------
I assume this is a bug because I can't find any spec or test for this behaviour:

Consider the following script:
```ruby
payload = Marshal.dump("foo")

Marshal.load(payload, -> (obj) {
  if obj.is_a?(String)
    p [obj, obj.encoding]
  end
  obj
})
p [:final, string, string.encoding]
```

outputs:
```ruby
["foo", #<Encoding:ASCII-8BIT>]
[:final, "foo", #<Encoding:UTF-8>]
```

So `Marshal` call the proc before the string get its encoding assigned, this is because the encoding is stored alongside as a `TYPE_IVAR`. I think in such cases `Marshal` should delay calling the proc until the object is fully restored.

A corollary to this behaviour is that the following code:

```ruby
Marshal.load(payload, :freeze.to_proc)
```

raises with `can't modify frozen String: "foo" (FrozenError)`.




-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>