[ruby-core:64822] [ruby-trunk - Bug #10209] attr_reader vulnerability

Issue #10209 has been updated by Nobuyoshi Nakada.

Description updated

And, when you wonder if it is a vulnerability, please feel free to post to [e-mail], instead of an issue here.

----------------------------------------
Bug #10209: attr_reader vulnerability
https://bugs.ruby-lang.org/issues/10209#change-48701

* Author: Carlos Luis Rojas Aragon辿s
* Status: Rejected
* Priority: Normal
* Assignee: 
* Category: core
* Target version: 
* ruby -v: ruby 2.0.0p247 (2013-06-27) [i586-linux]
* Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN
----------------------------------------
It is possible to change a read_only class attribute:

~~~ruby
require 'pp'
class Attributes
  attr_reader :string, :array, :hash
  def initialize
    @string = 'value'
    @array = [1, 2, 3, 4]
    @hash = { name: 'Carlos', age: 25 }
  end
end

instance = Attributes.new
pp 'Original atributes:'
pp '-------------------------'
pp instance.string
pp instance.array
pp instance.hash
pp '-------------------------'

# bang!!
# this should not afect the original atribute.
instance.string.gsub!(/.*/, '')
instance.array.clear
instance.hash.clear

pp 'After Hacking attributes:'
pp '-------------------------'
pp instance.string
pp instance.array
pp instance.hash
pp '-------------------------'
~~~

---Files--------------------------------
attributes.rb (628 Bytes)


-- 
https://bugs.ruby-lang.org/