From: Farrel Lifson <farrel.lifson@...>
Date: 2006-08-30T06:26:02+09:00
Subject: $SAFE =4 safe enough?

I'm implementing a system where users will be able to execute short
snippets of ruby code and It'll be executing in a thread with $SAFE
set to 4. From my reading it seems like there have been some
vulnerabilities where users can run some mischevous code. Is this
still the case? I know _why is working on Sandbox but I don't think I
will have it avaiable in my environment. I'm basically doing something
like the following:

thread = Thread.new do
  $SAFE=4
  instance_eval(userCode)
end
# 10 second timeout
if !thread.join(10)
  thread.kill
end

That tries to get rid of any potential DOS style attacks. Is there
anything else that could go wrong with this approach?

Farrel