From: Daniel DeLorme <dan-ml@...42.com>
Date: 2007-01-23T17:05:57+09:00
Subject: Re: Recursive send

Curtis Summers wrote:
>> But I then realized that was a major security hole. It allows an attacker
>> to post stuff like:
>>   <input name="blog[connection.drop_database.something]"
>> By the time the recursive send fails on "something=", the database has
>> already been wiped. Well, this example doesn't really work (drop_database
>> requires an argument), but you get the idea.
> 
> Well, if you are going to send an unescaped, form submitted value to
> rsend, then, yes, that would be a security hole.  But that's kind of
> like saying you're going to allow an unescaped, client submitted value
> to eval--which would be silly.

Heheh. True to a certain extent, but while sending an unescaped string to
eval is obviously crazy, send seems safer. After all, RoR relies on stuff
like <input name="obj[field]" absolutely all over the place. So it may not
be immediately apparent that <input name="obj[field.subfield]" is far more
dangerous.

But on the original topic, my own implementation of rsend was more like this:
  class Object
    def rsend(msg, *others)
      result = send(msg)
      result = result.rsend(*others) unless others.empty?
      result
    end
  end
This allows a class to override the rsend method in order to provide specific
behavior, e.g. in case send(msg) returns nil.

Daniel