From: Aredridel <aredridel@...>
Date: 2004-09-03T05:46:42+09:00
Subject: Re: Not just $SAFE, but damn $SAFE

On Fri, 2004-09-03 at 02:01 +0900, Dave Fayram wrote:
> I asked this question quite some time ago, doing the exact same thing (because having programmable bots that are also safe is really neat!). 
> 
> Matz provided exactly what I wanted. Once you get your object back, you can't trust it, but you can make a new string from it with relative safety:
> 
> sprime = String.new( tainted_string )
> 
> This gets around most kinds of method hacking.

What if I make Bad#to_str in this context?

Try this on:

class EvilStr < String
  def to_str
    puts "Haha2"
  end
end

class Bad
  def to_str
    puts "Haha!"
    EvilStr.new("Boo")
  end
end

puts String.new(Bad.new.taint)