From: Charles Oliver Nutter <charles.nutter@...>
Date: 2009-01-13T00:21:24+09:00
Subject: Re: Binding.of_caller examples don't work.

Bill Kelly wrote:
> If we're calling untrusted code and giving it full execution privileges, 
> then
> I think Binding.of_caller is the least of our worries.  The untrusted code
> could as easily `rm -rf ~` or innumerable other evil things.
> 
> Untrusted code needs to be sandboxed.

Sandboxing is made nearly impossible if calls in your own chain can 
escalate privileges by executing code from your binding. This is the 
primary reason why prototype continuation support for the JVM probably 
will never be shipped...the ability to implicitly access things 
elsewhere in the call stack has all sorts of really nasty security 
issues, even in a pretty secure environment like the JVM.

> Seems we could either make Binding.of_caller not work at all if $SAFE
> is >= 3 ... or preferably, if it's possible for the interpreter to 
> determine
> whether the caller's binding would have a lower $SAFE level than the
> current binding, then only raise a SecurityException in that case.
> 
> Would this address your security concerns?

No, because JRuby doesn't support $SAFE. It's a blunt instrument that I 
don't think anyone has ever audited for actual safety. So as a result, 
anyone believing $SAFE is actually safe is probably introducing even 
more risk into their apps.

Also, $SAFE is a global thing, and you can't localize it to a given 
binding, so that wouldn't work anyway.

Honestly, if you want a binding, pass one in.

- Charlie