From: Dave Fayram <kirindave@...>
Date: 2004-09-03T02:01:48+09:00
Subject: Re: Not just $SAFE, but damn $SAFE

I asked this question quite some time ago, doing the exact same thing (because having programmable bots that are also safe is really neat!). 

Matz provided exactly what I wanted. Once you get your object back, you can't trust it, but you can make a new string from it with relative safety:

sprime = String.new( tainted_string )

This gets around most kinds of method hacking.

--
Dave Fayram
  kirindave@lensmen.net
  dfayram@gmail.com
-- 

Aredridel <aredridel@nbtsc.org> wrote:

> I've been toying with an IRC bot that takes input from users in channel,
> evals it, and returns the result.
> 
> Doing so safely has proved to be a challenge -- the biggest problem
> being that you can't trust any method on the returned object.
> 
> Here's our solution, and I'd love to know if anyone can break it.
> 
> module Safe
>   def class
>     super
>   end
> end
> 
> def safe_to_s(obj)
>   t = Thread.new {
>     $SAFE = 4
>     obj.to_s
>   }
>   o = t.value
>   class << o
>     include Safe
>   end
>   if String == o.class
>     o
>   else
>     raise SecurityError
>   end
> end
> 
> def safe_eval(code)
>   t = Thread.new {
>      $SAFE = 4
>      eval(code)
>   }
>   t.value
> end
> 
> puts(safe_to_s(safe_eval("exit! # or variations")))
> 
> puts "Made it!"
> 
> 
> Consider this a challenge. The ways I broke simpler variants was to try
> to trick safe_to_s into calling methods outside of the safe Thread.
> 
> Ari
> 
> 
> 
>