[#6864] ruby 1.8.4 rc breaks alias_method/rails in bad ways — "Ara.T.Howard" <ara.t.howard@...>

20 messages 2005/12/09
[#6870] Re: ruby 1.8.4 rc breaks alias_method/rails in bad ways — =?ISO-8859-15?Q?Florian_Gro=DF?= <florgro@...> 2005/12/12

Ara.T.Howard wrote:

[#6872] Re: ruby 1.8.4 rc breaks alias_method/rails in bad ways — ara.t.howard@... 2005/12/12

On Tue, 13 Dec 2005, [ISO-8859-15] Florian Growrote:

[#6873] Re: ruby 1.8.4 rc breaks alias_method/rails in bad ways — James Edward Gray II <james@...> 2005/12/12

On Dec 12, 2005, at 1:19 PM, ara.t.howard@noaa.gov wrote:

[#6874] Re: ruby 1.8.4 rc breaks alias_method/rails in bad ways — ara.t.howard@... 2005/12/12

On Tue, 13 Dec 2005, James Edward Gray II wrote:

[#6891] Time.utc! and Time.localtime! — Daniel Hobe <hobe@...>

Writing a script yesterday I found out, much to my surprise, that the

16 messages 2005/12/14

[#6918] change to yaml in 1.8.4 — ara.t.howard@...

14 messages 2005/12/16

[#6934] 1.8.x, YAML, and release management — Ryan Davis <ryand-ruby@...>

I'm concerned that 1.8.3's acceptance of non-backwards-compatible

28 messages 2005/12/18

[#6996] Problems building 1.8.4 with VS8 C++ Express Edition (cl 14.00) — Austin Ziegler <halostatue@...>

Visual Studio C++ 2005 Express Edition (VS 8.0)

20 messages 2005/12/27

refurbishing ipaddr.rb - Class IPAddr?

From: hadmut@... (Hadmut Danisch)
Date: 2005-12-15 17:05:14 UTC
List: ruby-core #6909
Hi, 

I was working a little bit with the IPAddr class defined in
ipaddr.rb. From my point of view, it contains some shortcomings and
flaws and should undergo some update or revision:


- Security might be an issue. If I use the class in an environment
  with $SAFE=2 and a tainted IP address string, the underlying binary
  code issues an exception (correct), but ipaddr.rb does not 
  deal with that correctly:

  Exception: invalid address  (ArgumentError)
  /usr/lib/ruby/1.8/ipaddr.rb:423:in `initialize'

  

  It seems as if the networking libraries do not correctly deal with
  tainted variables or variables to be tainted.

  E.g. if I do a name resolution with Socket.gethostbyaddr, the result
  is not tainted, although it might contain any rubbish from the ugly
  world outside.



- ipaddr.rb uses the same class for single IP addresses and IP address
  ranges. That's wrong. Although a single IP address might have an
  address mask length to describe the network it belongs to, it
  significantly differs from an IP address range. Furthermore, an
  address range requires different methods. I can't open a TCP
  connection to an address range, but I could have an each iterator
  for that range, and other stuff. 

  It is also important to distinguish between an IP address and a DNS
  domain name. This is not the same.

  I strongly suggest to split this into three classes, address,
  address range, and DNS name. 


- Many new functions should be implemented. e.g. new IPv6
  conversions like 6to4, IP address arithmetics, using IP addresses as
  hash keys, address classification, etc.

  This could include also functions about the operating system,
  e.g. ping, arp, and things like that.


- DNS support is poor. There should be several new functions for DNS
  queries. Could be done as methods of a DNSname class.




regards
Hadmut




In This Thread

Prev Next