From: Hidetoshi NAGAI Date: 2003-10-24T18:51:35+09:00 Subject: [ruby-dev:21704] Re: access ENV on $SAFE==4 永井@知能．九工大です． From: nobu.nakada@nifty.ne.jp Subject: [ruby-dev:21698] Re: access ENV on $SAFE==4 Date: Thu, 23 Oct 2003 19:23:56 +0900 Message-ID: <200310231023.h9NANti9008648@sharui.nakada.kanuma.tochigi.jp> > 定数名とセキュリティレベルのハッシュを、モジュールの隠しインス > タンス変数として持たせる、というのはどうでしょう。 この方針で作り直してみました． 前回と重複する部分もありますが，追加されている機能/メソッドは， ----< $LOAD_PATH ($:, $-I) >------------------------ $SAFE >= 4 でのアクセスが禁止される． ．．．としていますが，ENV の許可レベルに連動させるという選択も ありという気がします． ---------------------------------------------------- ----< ENV >----------------------------------------- ENV.secure_level : 環境変数へのアクセス許可レベルを返す． : 環境変数にアクセスするためには，現在の $SAFE が : この値よりも小さくなければならない． ENV.secure_level=(level) : 環境変数へのアクセス許可レベルを level に設定する． : 変更できるレベルは level >= $SAFE ，かつ， : level <= [現在のアクセス許可レベル] でなければならない． ENV.allow?(name) : 環境変数 name (文字列指定) への現在の $SAFE でのアクセスが : 許可されていれば true を，許可されていなければ false を返す． ENV.allows : 現在許可されている環境変数のリストを得る． : ただし，現在の $SAFE でのアクセスが許可されていなければ : 例外を発生する． ENV.allow(name) : 環境変数 name への $SAFE >=4 でのアクセスを許可する． : ただし，現在の $SAFE でのアクセスが許可されていなければ : 例外を発生する． ENV.deny(name) : 環境変数 name への $SAFE >=4 でのアクセスを禁止する． : ただし，現在の $SAFE でのアクセスが許可されていなければ : 例外を発生する． ---------------------------------------------------- ----< Module >-------------------------------------- Module#secure_const(const_sym, level = 4) : module/class において，シンボル const_sym で表される定数の : アクセス許可レベルを level にする． : 変更できるレベルは level >= $SAFE ，かつ， : level <= [現在のアクセス許可レベル] でなければならない． Module#secure_const?(const_sym) : module/class において，アクセス許可レベルが設定されている場合は : そのレベルを，設定されていない場合には false を返す． Module#secure_constants : module/class において，アクセス許可レベルが設定されている定数の : 一覧を { [定数シンボル]=>[許可レベル], ... } のハッシュで返す． ---------------------------------------------------- ----< RUBY_PLATFORM (PLATFORM) >-------------------- Object.secure_const(:RUBY_PLATFORM, 4) および Object.secure_const(:PLATFORM, 4) で定義した形式になっている． ---------------------------------------------------- 以上です． テストが十分ではないかもしれませんが，お試し下さい． Index: eval.c =================================================================== RCS file: /src/ruby/eval.c,v retrieving revision 1.573 diff -u -r1.573 eval.c --- eval.c 23 Oct 2003 02:19:00 -0000 1.573 +++ eval.c 24 Oct 2003 09:24:35 -0000 @@ -6420,6 +6420,16 @@ } static VALUE +loadpath_getter(id) + ID id; +{ + if (rb_safe_level() >= 4) { + return rb_ary_new(); + } + return rb_load_path; +} + +static VALUE rb_f_local_variables() { ID *tbl; @@ -6719,9 +6729,9 @@ Init_load() { rb_load_path = rb_ary_new(); - rb_define_readonly_variable("$:", &rb_load_path); - rb_define_readonly_variable("$-I", &rb_load_path); - rb_define_readonly_variable("$LOAD_PATH", &rb_load_path); + rb_define_hooked_variable("$:", &rb_load_path, loadpath_getter, 0); + rb_define_hooked_variable("$-I", &rb_load_path, loadpath_getter, 0); + rb_define_hooked_variable("$LOAD_PATH", &rb_load_path, loadpath_getter, 0); rb_features = rb_ary_new(); rb_define_readonly_variable("$\"", &rb_features); Index: hash.c =================================================================== RCS file: /src/ruby/hash.c,v retrieving revision 1.116 diff -u -r1.116 hash.c --- hash.c 1 Aug 2003 20:16:48 -0000 1.116 +++ hash.c 24 Oct 2003 09:24:36 -0000 @@ -44,7 +44,8 @@ VALUE rb_cHash; -static VALUE envtbl; +static VALUE envtbl, allowed_envkeys; +static int env_secure_level = 4; static ID id_hash, id_call, id_default; VALUE @@ -1001,12 +1002,117 @@ } static VALUE +env_secure_lvl(obj) + VALUE obj; +{ + return INT2FIX(env_secure_level); +} + +static VALUE +env_set_secure_lvl(obj, level) + VALUE obj; + VALUE level; +{ + int lvl = NUM2INT(level); + + if (lvl < rb_safe_level()) { + rb_raise(rb_eSecurityError, + "Insecure: new level must be larger or equal to $SAFE"); + } + if (lvl > env_secure_level) { + rb_raise(rb_eSecurityError, + "Insecure: new level must be less or equal to current:%d", + env_secure_level); + } + env_secure_level = lvl; + return INT2FIX(env_secure_level); +} + +static ID id_case_conv; + +static int +env_allow_i(name) + VALUE name; +{ + VALUE key; + + StringValue(name); +#ifdef ENV_IGNORECASE + key = rb_funcall(name, id_case_conv, 0); +#else + key = name; +#endif + if (RTEST(rb_ary_includes(allowed_envkeys, key))) { + return 1; + } else { + return 0; + } +} + +static VALUE +env_allow_p(obj, name) + VALUE obj, name; +{ + if (env_allow_i(name)) { + return Qtrue; + } else { + return Qfalse; + } +} + +static VALUE +env_allow_list(obj) + VALUE obj; +{ + rb_secure(env_secure_level); + return rb_ary_dup(allowed_envkeys); +} + +static VALUE +env_allow(obj, name) + VALUE obj, name; +{ + VALUE key; + + rb_secure(env_secure_level); + if (!env_allow_i(name)) { + StringValue(name); +#ifdef ENV_IGNORECASE + key = rb_funcall(name, id_case_conv, 0); +#else + key = name; +#endif + rb_ary_push(allowed_envkeys, name); + } + return key; +} + +static VALUE +env_deny(obj, name) + VALUE obj, name; +{ + VALUE key; + + rb_secure(env_secure_level); + StringValue(name); +#ifdef ENV_IGNORECASE + key = rb_funcall(name, id_case_conv, 0); +#else + key = name; +#endif + if (RTEST(rb_ary_delete(allowed_envkeys, key))) { + return key; + } + return Qnil; +} + +static VALUE env_delete(obj, name) VALUE obj, name; { char *nam, *val; - rb_secure(4); + rb_secure(env_secure_level); SafeStringValue(name); nam = RSTRING(name)->ptr; if (strlen(nam) != RSTRING(name)->len) { @@ -1052,6 +1158,13 @@ if (strlen(nam) != RSTRING(name)->len) { rb_raise(rb_eArgError, "bad environment variable name"); } + if (rb_safe_level() >= env_secure_level) { + /* allowed key? */ + if (!env_allow_i(name)) { + /* not allowed */ + return Qnil; + } + } env = getenv(nam); if (env) { #ifdef ENV_IGNORECASE @@ -1084,7 +1197,12 @@ if (strlen(nam) != RSTRING(key)->len) { rb_raise(rb_eArgError, "bad environment variable name"); } - env = getenv(nam); + if (rb_safe_level() >= env_secure_level && !env_allow_i(key)) { + /* not allowed */ + env = (char*)NULL; + } else { + env = getenv(nam); + } if (!env) { if (rb_block_given_p()) { if (argc > 1) { @@ -1241,7 +1359,7 @@ { char *name, *value; - if (rb_safe_level() >= 4) { + if (rb_safe_level() >= env_secure_level) { rb_raise(rb_eSecurityError, "cannot change environment variable"); } @@ -1287,7 +1405,10 @@ while (*env) { char *s = strchr(*env, '='); if (s) { - rb_ary_push(ary, env_str_new(*env, s-*env)); + VALUE k = env_str_new(*env, s-*env); + if (rb_safe_level() < env_secure_level || env_allow_i(k)) { + rb_ary_push(ary, k); + } } env++; } @@ -1318,7 +1439,10 @@ while (*env) { char *s = strchr(*env, '='); if (s) { - rb_ary_push(ary, env_str_new2(s+1)); + if (rb_safe_level() < env_secure_level + || env_allow_i(env_str_new(*env,s-*env))) { + rb_ary_push(ary, env_str_new2(s+1)); + } } env++; } @@ -1351,8 +1475,11 @@ while (*env) { char *s = strchr(*env, '='); if (s) { - rb_ary_push(ary, env_str_new(*env, s-*env)); - rb_ary_push(ary, env_str_new2(s+1)); + VALUE k = env_str_new(*env, s-*env); + if (rb_safe_level() < env_secure_level || env_allow_i(k)) { + rb_ary_push(ary, k); + rb_ary_push(ary, env_str_new2(s+1)); + } } env++; } @@ -1371,7 +1498,7 @@ long i; int del = 0; - rb_secure(4); + rb_secure(env_secure_level); keys = env_keys(); for (i=0; ilen; i++) { @@ -1431,8 +1558,10 @@ if (s) { VALUE k = env_str_new(*env, s-*env); VALUE v = env_str_new2(s+1); - if (RTEST(rb_yield_values(2, k, v))) { - rb_ary_push(result, rb_assoc_new(k, v)); + if (rb_safe_level() < env_secure_level || env_allow_i(k)) { + if (RTEST(rb_yield_values(2, k, v))) { + rb_ary_push(result, rb_assoc_new(k, v)); + } } } env++; @@ -1448,7 +1577,7 @@ volatile VALUE keys; long i; - rb_secure(4); + rb_secure(env_secure_level); keys = env_keys(); for (i=0; ilen; i++) { @@ -1477,15 +1606,18 @@ while (*env) { char *s = strchr(*env, '='); - if (env != environ) { - rb_str_buf_cat2(str, ", "); - } if (s) { - rb_str_buf_cat2(str, "\""); - rb_str_buf_cat(str, *env, s-*env); - rb_str_buf_cat2(str, "\"=>"); - i = rb_inspect(rb_str_new2(s+1)); - rb_str_buf_append(str, i); + if (rb_safe_level() < env_secure_level + || env_allow_i(env_str_new(*env,s-*env))) { + if (env != environ) { + rb_str_buf_cat2(str, ", "); + } + rb_str_buf_cat2(str, "\""); + rb_str_buf_cat(str, *env, s-*env); + rb_str_buf_cat2(str, "\"=>"); + i = rb_inspect(rb_str_new2(s+1)); + rb_str_buf_append(str, i); + } } env++; } @@ -1506,8 +1638,10 @@ while (*env) { char *s = strchr(*env, '='); if (s) { - rb_ary_push(ary, rb_assoc_new(env_str_new(*env, s-*env), - env_str_new2(s+1))); + VALUE k = env_str_new(*env, s-*env); + if (rb_safe_level() < env_secure_level || env_allow_i(k)) { + rb_ary_push(ary, rb_assoc_new(k, env_str_new2(s+1))); + } } env++; } @@ -1524,14 +1658,22 @@ static VALUE env_size() { - int i; + int size = 0; char **env; env = GET_ENVIRON(environ); - for(i=0; env[i]; i++) - ; + while (*env) { + char *s = strchr(*env, '='); + if (s) { + if (rb_safe_level() < env_secure_level + || env_allow_i(env_str_new(*env,s-*env))) { + size++; + } + } + env++; + } FREE_ENVIRON(environ); - return INT2FIX(i); + return INT2FIX(size); } static VALUE @@ -1539,6 +1681,13 @@ { char **env; + if (rb_safe_level() >= env_secure_level) { + if (FIX2INT(env_size()) > 0) { + return Qtrue; + } else { + return Qfalse; + } + } env = GET_ENVIRON(environ); if (env[0] == 0) { FREE_ENVIRON(environ); @@ -1554,6 +1703,9 @@ { char *s; + if (rb_safe_level() >= env_secure_level && !env_allow_i(key)) { + return Qfalse; + } s = StringValuePtr(key); if (strlen(s) != RSTRING(key)->len) rb_raise(rb_eArgError, "bad environment variable name"); @@ -1572,13 +1724,16 @@ while (*env) { char *s = strchr(*env, '='); if (s++) { + VALUE k = env_str_new(*env, s-*env); + if (rb_safe_level() < env_secure_level || env_allow_i(k)) { #ifdef ENV_IGNORECASE - if (strncasecmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { + if (strncasecmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { #else - if (strncmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { + if (strncmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { #endif - FREE_ENVIRON(environ); - return Qtrue; + FREE_ENVIRON(environ); + return Qtrue; + } } } env++; @@ -1592,21 +1747,22 @@ VALUE dmy, value; { char **env; - VALUE str; StringValue(value); env = GET_ENVIRON(environ); while (*env) { char *s = strchr(*env, '='); if (s++) { + VALUE k = env_str_new(*env, s-*env); + if (rb_safe_level() < env_secure_level || env_allow_i(k)) { #ifdef ENV_IGNORECASE - if (strncasecmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { + if (strncasecmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { #else - if (strncmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { + if (strncmp(s, RSTRING(value)->ptr, strlen(s)) == 0) { #endif - str = env_str_new(*env, s-*env-1); - FREE_ENVIRON(environ); - return str; + FREE_ENVIRON(environ); + return k; + } } } env++; @@ -1631,7 +1787,12 @@ RARRAY(indexes)->ptr[i] = Qnil; } else { - RARRAY(indexes)->ptr[i] = env_str_new2(getenv(RSTRING(tmp)->ptr)); + if (rb_safe_level() >= env_secure_level && !env_allow_i(tmp)) { + RARRAY(indexes)->ptr[i] = Qnil; + } + else { + RARRAY(indexes)->ptr[i] = env_str_new2(getenv(RSTRING(tmp)->ptr)); + } } RARRAY(indexes)->len = i+1; } @@ -1649,8 +1810,10 @@ while (*env) { char *s = strchr(*env, '='); if (s) { - rb_hash_aset(hash, env_str_new(*env, s-*env), - env_str_new2(s+1)); + VALUE key = env_str_new(*env, s-*env); + if (rb_safe_level() < env_secure_level || env_allow_i(key)) { + rb_hash_aset(hash, key, env_str_new2(s+1)); + } } env++; } @@ -1809,11 +1972,25 @@ rb_define_method(rb_cHash,"key?", rb_hash_has_key, 1); rb_define_method(rb_cHash,"value?", rb_hash_has_value, 1); +#if defined(__human68k__) + id_case_conv = rb_intern("downcase"); +#else + id_case_conv = rb_intern("upcase"); +#endif + #ifndef __MACOS__ /* environment variables nothing on MacOS. */ origenviron = environ; envtbl = rb_obj_alloc(rb_cObject); rb_extend_object(envtbl, rb_mEnumerable); + allowed_envkeys = rb_ary_new(); + rb_global_variable(&allowed_envkeys); + rb_define_singleton_method(envtbl,"secure_level", env_secure_lvl, 0); + rb_define_singleton_method(envtbl,"secure_level=", env_set_secure_lvl, 1); + rb_define_singleton_method(envtbl,"allow?", env_allow_p, 1); + rb_define_singleton_method(envtbl,"allows", env_allow_list, 0); + rb_define_singleton_method(envtbl,"allow", env_allow, 1); + rb_define_singleton_method(envtbl,"deny", env_deny, 1); rb_define_singleton_method(envtbl,"[]", rb_f_getenv, 1); rb_define_singleton_method(envtbl,"fetch", env_fetch, -1); rb_define_singleton_method(envtbl,"[]=", env_aset, 2); Index: intern.h =================================================================== RCS file: /src/ruby/intern.h,v retrieving revision 1.137 diff -u -r1.137 intern.h --- intern.h 14 Oct 2003 02:53:53 -0000 1.137 +++ intern.h 24 Oct 2003 09:24:36 -0000 @@ -476,6 +476,9 @@ void rb_define_class_variable _((VALUE, const char*, VALUE)); VALUE rb_mod_class_variables _((VALUE)); VALUE rb_mod_remove_cvar _((VALUE, VALUE)); +int rb_const_secure_level _((VALUE, ID)); +int rb_const_secure_level_set _((VALUE, ID, int)); +VALUE rb_mod_secure_constants _((VALUE)); /* version.c */ void ruby_show_version _((void)); void ruby_show_copyright _((void)); Index: object.c =================================================================== RCS file: /src/ruby/object.c,v retrieving revision 1.129 diff -u -r1.129 object.c --- object.c 13 Aug 2003 07:13:45 -0000 1.129 +++ object.c 24 Oct 2003 09:24:36 -0000 @@ -908,6 +908,53 @@ } static VALUE +rb_mod_secure_const(argc, argv, klass) + int argc; + VALUE *argv; + VALUE klass; +{ + VALUE name, level; + ID id; + int current, target = 4; + + if (rb_scan_args(argc, argv, "11", &name, &level) == 2) { + if ((target = NUM2INT(level)) < 0) { + rb_raise(rb_eArgError, "level must be positive"); + } + } + id = rb_to_id(name); + if (!rb_is_const_id(id)) { + rb_name_error(id, "wrong constant name %s", rb_id2name(id)); + } + + current = rb_const_secure_level(klass, id); + if (current >= 0 && target > current) { + rb_raise(rb_eSecurityError, + "Insecure: new level must be less or equal to current:%d", + current); + } + if (target < rb_safe_level()) { + rb_raise(rb_eSecurityError, + "Insecure: new level must be larger or equal to $SAFE"); + } + + return INT2FIX(rb_const_secure_level_set(klass, id, target)); +} + +VALUE +rb_mod_secure_const_p(mod, var) + VALUE mod; + VALUE var; +{ + int level; + + if ((level = rb_const_secure_level(mod, rb_to_id(var))) < 0) { + return Qfalse; + } + return INT2NUM(level); +} + +static VALUE rb_mod_const_defined(mod, name) VALUE mod, name; { @@ -1527,6 +1574,10 @@ rb_define_method(rb_cModule, "const_missing", rb_mod_const_missing, 1); rb_define_method(rb_cModule, "class_variables", rb_mod_class_variables, 0); rb_define_private_method(rb_cModule, "remove_class_variable", rb_mod_remove_cvar, 1); + + rb_define_method(rb_cModule, "secure_const", rb_mod_secure_const, -1); + rb_define_method(rb_cModule, "secure_constants", rb_mod_secure_constants, 0); + rb_define_method(rb_cModule, "secure_const?", rb_mod_secure_const_p, 1); rb_define_method(rb_cClass, "allocate", rb_obj_alloc, 0); rb_define_method(rb_cClass, "new", rb_class_new_instance, -1); Index: variable.c =================================================================== RCS file: /src/ruby/variable.c,v retrieving revision 1.107 diff -u -r1.107 variable.c --- variable.c 13 Oct 2003 14:57:36 -0000 1.107 +++ variable.c 24 Oct 2003 09:24:36 -0000 @@ -21,6 +21,7 @@ static st_table *rb_global_tbl; st_table *rb_class_tbl; static ID autoload, classpath, tmp_classpath; +static ID secured_consts; void Init_var_tables() @@ -30,6 +31,7 @@ autoload = rb_intern("__autoload__"); classpath = rb_intern("__classpath__"); tmp_classpath = rb_intern("__tmp_classpath__"); + secured_consts = rb_intern("__secured_contants__"); } struct fc_result { @@ -1273,8 +1275,16 @@ int exclude, recurse; { VALUE value, tmp; + int level; int mod_retry = 0; + level = rb_const_secure_level(klass, id); + if (level >= 0 && rb_safe_level() >= level) { + rb_raise(rb_eSecurityError, + "Insecure: can't access constant %s on $SAFE >= %d", + rb_id2name(id), level); + } + tmp = klass; retry: while (tmp) { @@ -1430,6 +1440,104 @@ return rb_const_list(rb_mod_const_of(mod, 0)); } +int +rb_const_secure_level_0(klass, id, exclude, recurse) + VALUE klass; + ID id; + int exclude, recurse; +{ + VALUE tmp, table, val; + int mod_retry = 0; + + tmp = klass; + retry: + while (tmp) { + table = ivar_get(tmp, secured_consts, 0); + if (TYPE(table) == T_HASH && st_lookup(RHASH(table)->tbl, ID2SYM(id), &val)) { + if (exclude && tmp == rb_cObject && klass != rb_cObject) { + rb_warn("secure-level of toplevel constant %s referenced by %s::%s", + rb_id2name(id), rb_class2name(klass), rb_id2name(id)); + } + return NUM2INT(val); + } + if (!recurse && klass != rb_cObject) break; + tmp = RCLASS(tmp)->super; + } + if (!exclude && !mod_retry && BUILTIN_TYPE(klass) == T_MODULE) { + mod_retry = 1; + tmp = rb_cObject; + goto retry; + } + + return -1; +} + +int +rb_const_secure_level_from(klass, id) + VALUE klass; + ID id; +{ + return rb_const_secure_level_0(klass, id, Qtrue, Qtrue); +} + +int +rb_const_secure_level(klass, id) + VALUE klass; + ID id; +{ + return rb_const_secure_level_0(klass, id, Qfalse, Qtrue); +} + +int +rb_const_secure_level_at(klass, id) + VALUE klass; + ID id; +{ + return rb_const_secure_level_0(klass, id, Qtrue, Qfalse); +} + +int +rb_const_secure_level_set(klass, id, level) + VALUE klass; + ID id; + int level; +{ + VALUE table; + int current = rb_const_secure_level(klass, id); + + if (level < rb_safe_level()) { + rb_raise(rb_eSecurityError, + "Insecure: new level must be larger or equal to $SAFE"); + } + if (current >= 0 && level > current) { + rb_raise(rb_eSecurityError, + "Insecure: new level must be less or equal to current:%d", + current); + } + + table = ivar_get(klass, secured_consts, 0); + if (TYPE(table) != T_HASH) { + table = rb_hash_new(); + rb_ivar_set(klass, secured_consts, table); + } + + return rb_hash_aset(table, ID2SYM(id), INT2NUM(level)); +} + +VALUE +rb_mod_secure_constants(mod) + VALUE mod; +{ + VALUE table = ivar_get(mod, secured_consts, 0); + + if (TYPE(table) != T_HASH) { + /* no table */ + return rb_obj_freeze(rb_hash_new()); + } + + return rb_obj_freeze(rb_obj_dup(table)); +} + static int rb_const_defined_0(klass, id, exclude, recurse) VALUE klass; @@ -1517,6 +1625,14 @@ ID id; VALUE val; { + int level = rb_const_secure_level(klass, id); + + if (level >= 0 && rb_safe_level() >= level) { + rb_raise(rb_eSecurityError, + "Insecure: can't change constant %s on $SAFE >= %d", + rb_id2name(id), level); + return; + } mod_av_set(klass, id, val, Qtrue); } Index: version.c =================================================================== RCS file: /src/ruby/version.c,v retrieving revision 1.8 diff -u -r1.8 version.c --- version.c 16 Jan 2003 07:34:03 -0000 1.8 +++ version.c 24 Oct 2003 09:24:36 -0000 @@ -24,11 +24,13 @@ rb_define_global_const("RUBY_VERSION", v); rb_define_global_const("RUBY_RELEASE_DATE", d); rb_define_global_const("RUBY_PLATFORM", p); + rb_const_secure_level_set(rb_cObject, rb_intern("RUBY_PLATFORM"), 4); /* obsolete constants */ rb_define_global_const("VERSION", v); rb_define_global_const("RELEASE_DATE", d); rb_define_global_const("PLATFORM", p); + rb_const_secure_level_set(rb_cObject, rb_intern("PLATFORM"), 4); } void -- 永井 秀利 （九工大 知能情報） nagai@ai.kyutech.ac.jp