From: "shugo (Shugo Maeda)" <redmine@...>
Date: 2013-02-13T11:16:31+09:00
Subject: [ruby-core:52177] [ruby-trunk - Feature #7839] Symbol.freeze_symbols


Issue #7839 has been updated by shugo (Shugo Maeda).


phluid61 (Matthew Kerwin) wrote:
> Also, would you expect to be able to thaw it out again?  It might be enough in the short term to, e.g.
>     begin
>       Symbol.freeze_symbols
>       YAML.load(...)
>     ensure
>       Symbol.thaw_symbols
>     end

If this is a main use case of Symbol.freeze_symbols, it might be better to have String#intern's option to control whether a symbol creation is allowed and to make YAML.safe_load to use it.

   :foo
   "foo".intern #=> :foo
   "bar".intern #=> :bar
   "foo".intern(allow_new: false) #=> :foo
   "bar".intern(allow_new: false) #=> error

I guess it can be implemented easily compared to Symbol GC.

----------------------------------------
Feature #7839: Symbol.freeze_symbols
https://bugs.ruby-lang.org/issues/7839#change-36192

Author: tenderlovemaking (Aaron Patterson)
Status: Open
Priority: Normal
Assignee: 
Category: 
Target version: 


Hi,

On team Rails, we're having troubles with Symbol creation DoS attacks.  From our perspective, there should be a point in the application where symbols should stabilize, meaning we don't expect the number of symbols to increase while the process is running.

I'd like to be able to call a method like `Symbol.freeze_symbols` which would essentially freeze the symbol hash, such that if any new symbols are created, an exception would be thrown.

I can work on a patch for this, but I wanted to throw the idea out there.


-- 
http://bugs.ruby-lang.org/