From: "headius (Charles Nutter)" <headius@...>
Date: 2013-03-15T15:41:27+09:00
Subject: [ruby-core:53436] [ruby-trunk - Bug #8099][Open] Time can be mutated by send :initialize


Issue #8099 has been reported by headius (Charles Nutter).

----------------------------------------
Bug #8099: Time can be mutated by send :initialize
https://bugs.ruby-lang.org/issues/8099

Author: headius (Charles Nutter)
Status: Open
Priority: Normal
Assignee: 
Category: 
Target version: 
ruby -v: 2.0.0p0


It is possible to alter the value of a given Time object by re-sending :initialize. No other methods can cause the time to be mutated, and I believe no method should modify the value of an already-initialized Time object.

Some examples:

ext-jruby-local ~/projects/jruby $ ruby2.0.0 -e "t = Time.now; p t; sleep 2; t.send(:initialize); p t"
2013-03-15 01:21:34 -0500
2013-03-15 01:21:36 -0500

ext-jruby-local ~/projects/jruby $ ruby2.0.0 -e "t = Time.now; p t; t.send(:initialize, 2013, 03, 14); p t"
2013-03-15 01:22:24 -0500
2013-03-14 00:00:00 -0500

If time is critical in an application and you can't trust that the Time object is immutable, all sorts of nasty tricks are possible.

Freezing does prevent reinitialization, but it seems like Time (or its value, at least!) should be immutable by default.

All codebases based on MRI's Time implementation exhibit this behavior. All non-MRI implementations I tested did not allow reinitialization or did not modify the Time object's value.

Note: Time#localtime does modify the *time zone* of a target Time object, but that does not change the essential *value* of the object. I would like to see #localtime go away as well.


-- 
http://bugs.ruby-lang.org/