From: shiva.brahma@... (Matteo Cavalleri)
Date: 2007-01-07T00:10:12+09:00
Subject: mod_ruby security

I'm learning ruby and I'm currently enjoing reinventig the wheel just
for the sake to understand how things work under ruby and mod_ruby.
well, mod_ruby faq says:

"But on the other side, different scripts run using the same Ruby
interpreter, so a malicious script can change the behavior of the other
scripts."

what does it mean more precisely? what's the kind of access one script
may have to other scripts' variables/objects/classes? I'm sorry if the
question is old but my searches on the web weren't succesful...

anyway... let's suppose I've my brand new application with its database
class which opens a connection to the db with the correct user and
password, and a session class wich keeps track of user sessions, login,
etc. then I put my program on a web hosting service

how should I write my classes so that a malicious script running on the
same web hosting service can't access my db or get an authenticated
session by poking with my classes?

thanks in advance

-- 
Deh! Impiacciami, imploroti
sgabazzone rampante!