From: Aredridel <aredridel@...>
Date: 2004-09-03T04:13:28+09:00
Subject: Re: Not just $SAFE, but damn $SAFE

On Thu, 2004-09-02 at 16:11 +0900, Mehr, Assaph (Assaph) wrote:
> The string:
> 
> str = "
> s = 'blue eyes'
> def s.class
>   puts `ruby -v`
>   String
> end
> s"
> 
> puts(safe_to_s(safe_eval(str))) 
> 
> 
> 
> Outputs:
> 
> ruby 1.8.2 (2004-07-29) [i386-mswin32]
> blue eyes
> Made it!

Augh. It worked in the testbed.

Try this variation:

def safe_to_s(obj)
  t = Thread.new {
    $SAFE = 4
    obj.to_s
  }
  o = t.value
  def o.class
    super
  end
  if String == o.class
    o
  else
    raise SecurityError
  end
end

Ari