From: Eric Hodel <drbrain@...7.net>
Date: 2007-01-10T05:41:15+09:00
Subject: Re: Strange safe level change

On Jan 9, 2007, at 10:40, Gennady Bystritsky wrote:
> Eric Hodel wrote:
>> On Jan 8, 2007, at 22:29, Tom wrote:
>>
>>> Well I'm mailing about a problem I'm having while using the rails
>>> framework, since it does seem to be a ruby problem I thought I might
>>> as well post here
>>>
>>> I have a security level problem, for unknown reasons it switches
>>> from level 0 to level 4 and then provoke some error related to the
>>> security level...
>>
>> $SAFE is switched when you assign to it, never at any other time.
>
> Is it so? Consider the following code:
>
> Test.new.method(:show_safe).taint.call
>
> It produces:
>
> :!ruby safe.rb
> 1.8.4
> i686-linux
> 0
> safe.rb:5:in `write': Insecure operation `write' at level 4
> (SecurityError)
>         from safe.rb:5:in `show_safe'
>         from safe.rb:12

Interesting.

You are right.  From method_call:

     if (OBJ_TAINTED(method)) {
         safe = NOEX_WITH(data->safe_level, 4)|NOEX_TAINTED;
     }

$SAFE is only changed for the method invocation, it does not leak  
into the surrounding process.  puts $SAFE afterward shows the  
original safe level.

-- 
Eric Hodel - drbrain@segment7.net - http://blog.segment7.net

I LIT YOUR GEM ON FIRE!