From: ts <decoux@...>
Date: 2005-01-27T22:18:50+09:00
Subject: Re: When little languages grow...

>>>>> "H" == Hugh Sasse Staff Elec Eng <hgs@dmu.ac.uk> writes:

H> My understanding is

H>                valid_input = Thread.new(input){|source|
H>                   $SAFE=5
H>                   result = instance_eval source
H>                   final_result = validate(result)
H>                 }.value

 Well, a better example is

uln% cat b.rb
#!/usr/local/bin/ruby
source = <<EOT
a = Object.new
class << a
   def to_s
      puts "hello :-)"
      super
   end
end
a
EOT

puts Thread.new { $SAFE = 4; eval source }.value
uln% 

uln% b.rb
hello :-)
#<Object:0x2a955c0738>
uln% 


 i.e. you *MUST* validate the object with $SAFE = 4 and never trust it.



Guy Decoux