From: Kazuhiko Date: 2009-07-30T01:20:20+09:00 Subject: [ruby-list:46243] ruby-1.8.7で"Insecure: can't modify hash (SecurityError)" --------------070603040908090806020602 Content-Type: text/plain; charset=ISO-2022-JP Content-Transfer-Encoding: 7bit こんにちは、かずひこです。 添付のように、最近のruby-1.8系でtDiaryのセキュアモード（$SAFE=4）で "Insecure: can't modify hash (SecurityError)"というエラーが起き、遡って みると、 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=16081 Author: knu Date: Sat Apr 19 11:11:25 2008 UTC (15 months, 1 week ago) Log Message: * array.c (rb_ary_equal, rb_ary_eql, rb_ary_hash, rb_ary_cmp): Make Array#eql?, #hash, #== and #<=> use rb_exec_recursive() and handle recursive data properly. * hash.c (hash_equal, rb_hash_hash): Make Hash#eql?, #hash and #== use rb_exec_recursive() and handle recursive data properly. ↑この変更以降、このエラーが起きることがわかりました。 ちなみに、現在のruby_1_8ブランチの最新（rev.24312）に、上記の差分を逆適 応すれば、このエラーは起きません。sortで"can't modify hash"と言われるの はバグのような気がするのですが、どうでしょうか？ 状況報告だけですみませんが、どうぞよろしくお願いします。 かずひこ --------------070603040908090806020602 Content-Type: message/rfc822; name="Re: [tDiary-devel] =?ISO-2022-JP?B?cnVieS0xLjguNxskQiRHGyhCIkluc2VjdXJlOiA=?==?ISO-2022-JP?B?Y2FuJ3QgbW9kaWZ5IGhhc2ggKFNlY3VyaXR5RXJyb3IpIi5lbWw=?=" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename*0*=ISO-2022-JP''%52%65%3A%20%5B%74%44%69%61%72%79%2D%64%65%76%65; filename*1*=%6C%5D%20%72%75%62%79%2D%31%2E%38%2E%37%1B%24%42%24%47%1B%28; filename*2*=%42%22%49%6E%73%65%63%75%72%65%3A%20%63%61%6E%27%74%20%6D%6F; filename*3*=%64%69%66%79%20%68%61%73%68%20%28%53%65%63%75%72%69%74%79%45; filename*4*=%72%72%6F%72%29%22%2E%65%6D%6C Return-Path: X-Original-To: kazuhiko@fdiary.net Delivered-To: kazuhiko@fdiary.net Received: from fdiary.net (localhost [127.0.0.1]) by fdiary.net (Postfix) with ESMTP id 5F96018004E2 for ; Thu, 30 Jul 2009 00:50:37 +0900 (JST) Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) by fdiary.net (Postfix) with ESMTP id C612C1800803 for ; Thu, 30 Jul 2009 00:50:36 +0900 (JST) Received: from localhost ([127.0.0.1] helo=sfs-ml-3.v29.ch3.sourceforge.com) by h25xhf1.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1MWBP8-0007Tw-If; Wed, 29 Jul 2009 15:49:22 +0000 Received: from sfi-mx-3.v28.ch3.sourceforge.com ([172.29.28.123] helo=mx.sourceforge.net) by h25xhf1.ch3.sourceforge.com with esmtp (Exim 4.69) (envelope-from ) id 1MWBP2-0007T7-PW for tdiary-devel@lists.sourceforge.net; Wed, 29 Jul 2009 15:49:16 +0000 X-ACL-Warn: Received: from netforest.fdiary.net ([218.45.24.170] helo=fdiary.net) by 3b2kzd1.ch3.sourceforge.com with esmtp (Exim 4.69) id 1MWBOy-0005B3-9S for tdiary-devel@lists.sourceforge.net; Wed, 29 Jul 2009 15:49:16 +0000 Received: from fdiary.net (localhost [127.0.0.1]) by fdiary.net (Postfix) with ESMTP id D249718004E2 for ; Thu, 30 Jul 2009 00:49:03 +0900 (JST) Received: from [127.0.0.1] (netforest.fdiary.net [218.45.24.170]) by fdiary.net (Postfix) with ESMTP id 2F3FD1800803 for ; Thu, 30 Jul 2009 00:49:03 +0900 (JST) Message-ID: <4A706F6E.2010003@fdiary.net> Date: Wed, 29 Jul 2009 17:49:02 +0200 From: Kazuhiko User-Agent: Thunderbird 2.0.0.22 (X11/20090625) MIME-Version: 1.0 To: tdiary-devel@lists.sourceforge.net References: <4A6F0810.9030501@fdiary.net> <4A6FD84D.7010005@fdiary.net> In-Reply-To: X-Virus-Scanned: ClamAV using ClamSMTP X-Spam-Score: 0.9 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. 0.0 NORMAL_HTTP_TO_IP URI: Uses a dotted-decimal IP address in URL 0.9 AWL AWL: From: address is in the auto white-list X-Headers-End: 1MWBOy-0005B3-9S Subject: Re: [tDiary-devel] =?iso-2022-jp?b?cnVieS0xLjguNxskQiRHGyhCIkluc2Vj?= =?iso-2022-jp?b?dXJlOiBjYW4ndCBtb2RpZnkgaGFzaCAoU2VjdXJpdHlFcnJvciki?= X-BeenThere: tdiary-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list Reply-To: tdiary-devel@lists.sourceforge.net List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: 7bit Errors-To: tdiary-devel-bounces@lists.sourceforge.net X-Virus-Scanned: ClamAV using ClamSMTP TADA Tadashi wrote: > ちょっと忙しいので軽くレスしておくと、最近のrubyは$SAFEの仕様が > 変わったためか、tDiaryがセキュアモードで動いていません。かなり面倒 > そうなので、本腰入れて調べる時間が取れるまで放置中です......。 > > どのくらい遡れば動くのか、誰か調べてくれるとうれしいです(^^; ChangeLogであたりをつけつつ探索した結果、 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=16081 Author: knu Date: Sat Apr 19 11:11:25 2008 UTC (15 months, 1 week ago) Log Message: * array.c (rb_ary_equal, rb_ary_eql, rb_ary_hash, rb_ary_cmp): Make Array#eql?, #hash, #== and #<=> use rb_exec_recursive() and handle recursive data properly. * hash.c (hash_equal, rb_hash_hash): Make Hash#eql?, #hash and #== use rb_exec_recursive() and handle recursive data properly. 以降、このエラーが出ます。って、1年以上前なのかー。 > 2009/7/29 Kazuhiko : >>> http://www.tdiary.net/rubbs/support.rb?top=1134 >>> 第二で「Insecure: can't modify hash (SecurityError)」 >>> >>> で知ったのですが、ruby-1.8.7p72（etch backports）やruby-1.8.7-p174（sid >>> のをetchでビルドした）で、記録対称のリファラ付きのアクセスに対して、以下 >>> のようなエラーが出ました。環境は@secure=trueで、disp-referrerはアリでも >>> ナシでも一緒でした。 >>> >>> Insecure: can't modify hash (SecurityError) >>> >>> /home/tdiary/tdiary/core/tdiary.rb:285:in `<=>' >>> /home/tdiary/tdiary/core/tdiary.rb:110:in `join' >>> /home/tdiary/tdiary/core/tdiary.rb:110:in `safe' >>> /home/tdiary/tdiary/core/tdiary.rb:804:in `eval_src' >>> /home/tdiary/tdiary/core/tdiary.rb:1160:in `do_eval_rhtml' >>> /home/tdiary/tdiary/core/tdiary.rb:1092:in `eval_rhtml' >>> /home/tdiary/tdiary/core/tdiary.rb:1788:in `eval_rhtml' >>> /home/tdiary/users/test2/index.rb:81 >>> >>> 283 def each_referer( limit = 10 ) >>> 284 newer_referer >>> 285 @referers.values.sort.reverse.each_with_index do |ary,idx| >>> 286 break if idx >= limit >>> 287 yield ary[0], ary[1] >>> 288 end >>> 289 end >>> >>> etch公式のrubyバイナリ（1.8.5-4etch4）にすれば、このエラーは出ないのです >>> が、ruby本体の変更でこれに関係しそうなものに思い当たる方はいらっしゃいま >>> すか？ >> この件、tDiaryを使わない最小の再現コードが書ければいいのですが、今のとこ >> ろうまくいかずにいるのですが、tDiaryでの再現方法はこんな感じ。 >> >> 1. tdiary.confの末尾に >> @secure = true >> @no_referer = [] >> を追加して、セキュアモードにし、かつ、あらゆるリファラが記録されるように >> する。 >> >> 2. 以下のようなHTMLをlocalhostのhttpで取得できるところに置く。 >> test >> >> 3. 上記のHTMLを http://localhost/path/to/file や >> http://127.0.0.1/path/to/file などでアクセスしてリンクをふみ、複数種類の >> リファラを記録する >> >> 4. 上記のエラーが出る >> >> というわけで、引き続き情報をお待ちしています。 >> >> ちなみに、ruby-1.9だと、リファラ関係なく@secure=trueだと、こんなエラーが >> 出ます。 >> >> Insecure: can't modify instance variable (SecurityError) >> >> (TDiary::Plugin#eval_src):17:in `block in eval_src' >> /home/kazuhiko/public_html/diary/tdiary.rb:806:in `eval' >> /home/kazuhiko/public_html/diary/tdiary.rb:806:in `block in eval_src' >> /home/kazuhiko/public_html/diary/tdiary.rb:112:in `block in safe' >> >> こっちはもうちょっと根が深そうな気がします。 かずひこ ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july _______________________________________________ tDiary-devel mailing list tDiary-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tdiary-devel --------------070603040908090806020602--