From: Erik Veenstra <pan@...>
Date: 2006-01-25T19:23:12+09:00
Subject: String#de_inspect (and Kernel#suspicious)

If you do an inspect on a collection of Ruby objects, like a
hash, you end up with a string. It's possible to store this
string in a file, read it again somewhere in the future,
evaluate it and end up with the same collection of Ruby objects
in core.

So I've written this String#de_inspect, which uses
Kernel#suspicious (slow!) to avoid any malicious code from
being evaluated.

A kind of human-readable marshaling. That is-human-readable is
important, for me, in this situation.

(You can only dump objects which inspect to Ruby code, e.g.
Strings, Numerics, Symbols, Arrays, Hashes, nil, true and
false.)

I've attached the code and an example, though the example isn't
important.

Thoughts? Comments?

gegroet,
Erik V. - http://www.erikveen.dds.nl/

----------------------------------------------------------------

 module Kernel
   def suspicious(*parms, &block) # Just forget about the parms...
     Thread.new(*parms) do |*parms|
       $SAFE = 5

       block.call(*parms)
     end.value
   end
 end

 class String
   def de_inspect
     suspicious do
       eval(self, Module.new.module_eval{binding})
     end
   end
 end

 def journal(file)
   File.open(file) do |f|
     while (line = f.gets)
       yield(line.de_inspect)
     end
   end
 end

 journal("journal") do |x|
   p x
 end

----------------------------------------------------------------