[#5219] Segmentation fault in timeout.rb — Michel Pastor <K@...>

Hi,

18 messages 2005/06/16
[#5220] Re: Segmentation fault in timeout.rb — Eric Hodel <drbrain@...7.net> 2005/06/16

[#5221] Re: Segmentation fault in timeout.rb — Michel Pastor <K@...> 2005/06/16

On Fri, 17 Jun 2005 05:03:18 +0900

[#5223] Re: Segmentation fault in timeout.rb — nobu.nokada@... 2005/06/17

Hi,

[#5296] Subversion — Shugo Maeda <shugo@...>

Hi,

64 messages 2005/06/30
[#5297] Re: Subversion — Curt Hibbs <curt@...> 2005/06/30

Shugo Maeda wrote:

[#5298] Re: Subversion — Nikolai Weibull <mailing-lists.ruby-core@...> 2005/06/30

Curt Hibbs wrote:

[#5301] Re: Subversion — Austin Ziegler <halostatue@...> 2005/06/30

On 6/30/05, Nikolai Weibull

[#5304] Re: Subversion — Nikolai Weibull <mailing-lists.ruby-core@...> 2005/06/30

Austin Ziegler wrote:

[#5305] Re: Subversion — Austin Ziegler <halostatue@...> 2005/06/30

On 6/30/05, Nikolai Weibull

[#5307] Re: Subversion — mathew <meta@...> 2005/06/30

Austin Ziegler wrote:

[#5308] Re: Subversion — Austin Ziegler <halostatue@...> 2005/06/30

On 6/30/05, mathew <meta@pobox.com> wrote:

[#5311] Re: Subversion — mathew <meta@...> 2005/07/01

Austin Ziegler wrote:

[#5323] Re: Subversion — Austin Ziegler <halostatue@...> 2005/07/01

On 7/1/05, mathew <meta@pobox.com> wrote:

[#5325] Re: Subversion — Nikolai Weibull <mailing-lists.ruby-core@...> 2005/07/01

Austin Ziegler wrote:

arbitrary command execution on XMLRPC server

From: Nobuhiro IMAI <nov@...>
Date: 2005-06-17 10:41:03 UTC
List: ruby-core #5237
Hello,

I found that the default value modification on
Module#public_instance_methods (false -> true) breaks
s.add_handler(XMLRPC::iPIMethods("sample"), MyHandler.new) style
security protection. I guess the following patch will fix this
problem:


--- xmlrpc/utils.rb~    2004-11-16 08:25:58.000000000 +0900
+++ xmlrpc/utils.rb     2005-06-17 11:14:26.000000000 +0900
@@ -131,7 +131,7 @@

     def get_methods(obj, delim=".")
       prefix = @prefix + delim
-      obj.class.public_instance_methods.collect { |name|
+      obj.class.public_instance_methods(false).collect { |name|
         [prefix + name, obj.method(name).to_proc, nil, nil]
       }
     end


Regards,
--
Nobuhiro IMAI <nov@yo.rim.or.jp>
Key fingerprint = F39E D552 545D 7C64 D690  F644 5A15 746C BD8E 7106

In This Thread

Prev Next