From: "Mauricio Fernández" <batsman.geo@...>
Date: 2004-09-02T17:04:19+09:00
Subject: Re: Not just $SAFE, but damn $SAFE

On Thu, Sep 02, 2004 at 03:47:50PM +0900, Aredridel wrote:
> Here's our solution, and I'd love to know if anyone can break it.
> 
> module Safe
>   def class
>     super
>   end
> end
> 
> def safe_to_s(obj)
>   t = Thread.new {
>     $SAFE = 4
>     obj.to_s
>   }
>   o = t.value
>   class << o
>     include Safe
>   end
>   if String == o.class
better make it
       String === o
>     o
>   else
>     raise SecurityError
>   end
> end
> 
> def safe_eval(code)
>   t = Thread.new {
>      $SAFE = 4
>      eval(code)
>   }
>   t.value
> end
> 
> puts(safe_to_s(safe_eval("exit! # or variations")))
> 
> puts "Made it!"

Take a look at [107071].

We had quite some fun in #ruby-lang nearly 1 year ago trying to break
Florian Gro�' rubdo; the underlying code (safe.rb) was a quite more
involved, though.
It soon became apparent that it would be impossible to prevent DOS
attacks to rubdo:
* it was possible to block all threads with a slow builtin method (in C) like
  Bignum#** (and overcome the timeout mechanism)
* Thread.new and Object#define_finalizer proved to be evil (he had to
  disable them)
* symbols are not GCed; one could easily make flgr's machine swap to
  death by creating new symbols repeatedly

Most of them can be addressed with rlimit but he was using win32 :-)

-- 
Running Debian GNU/Linux Sid (unstable)
batsman dot geo at yahoo dot com