From: Eric Hodel <drbrain@...7.net>
Date: 2006-08-31T09:13:38+09:00
Subject: Re: $SAFE =4 safe enough?

On Aug 30, 2006, at 12:23 AM, snacktime wrote:

> There really isn't anything you can do to make this safe.  Even $SAFE
> itself can be set to a different value from the usercode.

$SAFE can only be increased.

$ ruby -e '$SAFE = 1; $SAFE = 0'-e:1: tried to downgrade safe level  
from 1 to 0 (SecurityError)

> Plus ruby threads aren't real threads, so I think someone could  
> just fork off a
> new process,

Not at $SAFE >= 2

$ ruby -e '$SAFE = 2; fork do puts "hi" end'
-e:1:in `fork': Insecure operation `fork' at level 2 (SecurityError)
         from -e:1

> or at the least it would be easy to lock up your whole application  
> by calling some blocking operation that takes forever.

Yes.

-- 
Eric Hodel - drbrain@segment7.net - http://blog.segment7.net
This implementation is HODEL-HASH-9600 compliant

http://trackmap.robotcoop.com