From: unbewusst.sein@... (=?ISO-8859-1?Q?Une_B=E9v?= =?ISO-8859-1?Q?ue?=)
Date: 2008-05-06T01:20:19+09:00
Subject: Re: [ANN] Erubis 2.6.0 released - a fast and extensible eRuby

makoto kuwata <kwa@kuwata-lab.com> wrote:

> I have released Erubis 2.6.0.

i do have the same security prob with this version, here is my Apache2
log :
[Mon May 05 17:51:45 2008] [notice] Apache/2.2.8 (Unix) mod_ssl/2.2.8
OpenSSL/0.9.8g DAV/2 mod_ruby/1.2.6 Ruby/1.8.6(2007-09-24) PHP/5.2.5
configured -- resuming normal operations
[Mon May 05 17:53:16 2008] [error] [client 127.0.0.1] File does not
exist: /Users/yt/Sites/favicon.ico
[Mon May 05 17:53:18 2008] [error] mod_ruby: error in ruby
[Mon May 05 17:53:18 2008] [error] mod_ruby:
/opt/local/lib/ruby/gems/1.8/gems/erubis-2.6.0/lib/erubis/evaluator.rb:6
2:in `eval': Insecure operation - eval (SecurityError)
[Mon May 05 17:53:18 2008] [error] mod_ruby:   from
/opt/local/lib/ruby/gems/1.8/gems/erubis-2.6.0/lib/erubis/evaluator.rb:6
2:in `result'
[Mon May 05 17:53:18 2008] [error] mod_ruby:   from
/Users/yt/Sites/erubis/example3.rbx:15
[Mon May 05 17:53:18 2008] [error] mod_ruby:   from
/opt/local/lib/ruby/1.8/apache/ruby-run.rb:53:in `load'
[Mon May 05 17:53:18 2008] [error] mod_ruby:   from
/opt/local/lib/ruby/1.8/apache/ruby-run.rb:53:in `handler'


example3.rbx is the same as yours, i've only changed extension to .rbx :
#! /usr/bin/env ruby -wx

#    example3.rb

require 'rubygems'
require 'erubis'

input=File.read('example3.eruby')
eruby=Erubis::EscapedEruby.new(input)

puts "-------- script source ---"
puts eruby.src
puts "-------- result ----------"
list=['<aaa>', 'b&b', '"ccc"']
puts eruby.result(binding())


-- 
Une B�vue