From: Eric Hodel <drbrain@...7.net>
Date: 2005-03-03T06:13:23+09:00
Subject: Re: Security Gotcha with $:

--Apple-Mail-50-494285604
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII; format=flowed

On 01 Mar 2005, at 16:37, John Carter wrote:

> I have just stumbled on a small security Gotcha in my code, that is 
> probably common to quite a lot of code...

[snip]

> So a Bad Hat (or just plain Murphy as in Murphy's Law)  could put his 
> own nasty version of MyModule.rb on the current working directory and 
> there after your App does Strange Things.
>
> Solution 1:
>
> $:.unshift "/The/place/where/my/ruby/modules/live"
>
> I don't like that as then if Murphy places anything with a module name 
> that is the same as a system module in 
> "/The/place/where/my/ruby/modules/live"
> then suddenly all system modules start behaving in mysterious ways.

This one is common.

> Solution 2:
>
>   $:.reject!{|p| p[0] != ?/} # Only allow absolute paths
>
>   $: << "/The/place/where/my/ruby/modules/live"
>
>   require 'MyModule'

Solution 3:

Use RUBYLIB:

$ env | grep RUBY
RUBYLIB=/Users/drbrain/lib/ruby/
$ ruby -e 'p $:'
["/Users/drbrain/lib/ruby/", "/usr/local/lib/ruby/site_ruby/1.8", 
"/usr/local/lib/ruby/site_ruby/1.8/powerpc-darwin7.7.0", 
"/usr/local/lib/ruby/site_ruby", "/usr/local/lib/ruby/1.8", 
"/usr/local/lib/ruby/1.8/powerpc-darwin7.7.0", "."]
[ ~/Work/svn/robotcoop/hugster/trunk ]


-- 
Eric Hodel - drbrain@segment7.net - http://segment7.net
FEC2 57F1 D465 EB15 5D6E  7C11 332A 551C 796C 9F04

--Apple-Mail-50-494285604
content-type: application/pgp-signature; x-mac-type=70674453;
	name=PGP.sig
content-description: This is a digitally signed message part
content-disposition: inline; filename=PGP.sig
content-transfer-encoding: 7bit

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFCJixkMypVHHlsnwQRAlx5AJ9tlbgHXK2HHhMX+Q6FDzfzN/gX8ACfYA94
9TB46SwSYBcCTMOpx8Qqke4=
=rW++
-----END PGP SIGNATURE-----

--Apple-Mail-50-494285604--