From: ara.t.howard@...
Date: 2005-12-08T10:22:39+09:00
Subject: Re: code execution from file?

On Thu, 8 Dec 2005, ako... wrote:

> hello,
>
> i have a text field in a database table (a text file, generally speaking),
> with arbitrary Ruby code. i would like to execute this code in my
> application's current environment. but i need to hide all my variables
> except for some specific ones from this code.
>
> so i was thinking to create a class with a static method that accepts
> parameters and put the content of the file in to this method. and pass the
> variables i want to expose as parameters.
>
> how is this done in ruby? i have never done it.
>
> in addition, how to execute this code with maximal security level?
>
> also, what would happen if the code reopened classes that i have created? is
> this possible? how to make it not do that?
>
> basically i want the user to type some code in to my application and run it
> but i want to protect against malicious users who want to erase my hard
> disk, etc. ;-)

     harp:~ > cat a.rb
     def run file, vars = {}
       code = IO::read file
       dumped = vars.inject({}){|d,kv| k, v = kv; d.update k => Marshal::dump(v)}
       Thread::new(vars, code) do |vars, code|
         $SAFE = 4
         program = ""
         dumped.each{|k,v| program << "#{ k } = Marshal::load <<-__data__\n#{ v }\n__data__\n\n"}
         program << code
         eval program
       end.value
     end

     value = run "b.rb", "a" => "forty-two"
     p value

     value = run "c.rb", "a" => "42"
     p value


     harp:~ > cat b.rb
     a.upcase


     harp:~ > cat c.rb
     a.center 42


     harp:~ > ruby a.rb
     "FORTY-TWO"
     "                    42                    "

hth.


-a
-- 
===============================================================================
| ara [dot] t [dot] howard [at] noaa [dot] gov
| all happiness comes from the desire for others to be happy.  all misery
| comes from the desire for oneself to be happy.
| -- bodhicaryavatara
===============================================================================