From: Philip Ross <phil.ross@...>
Date: 2009-04-16T04:18:51+09:00
Subject: Re: SecurityError requiring gems and other files with $SAFE=1 in Ruby   1.9.1

Philip Ross wrote:
> I get the following error trying to require gems (in this 
> example Rake, but I get the same error with other gems):
> 
>  >> $SAFE=1
> => 1
>  >> require 'rake'
> SecurityError: Insecure operation - require
>         from (irb):2:in `require'
>         from (irb):2
>         from /usr/local/ruby/1.9/bin/irb:12:in `<main>'

I've now found that if I bypass RubyGems and require rake manually using 
its full path, I don't get the SecurityError.

 >> $SAFE=1
=> 1
 >> require 
'/usr/local/ruby/snapshot/lib/ruby/gems/1.9.1/gems/rake-0.8.4/lib/rake'
=> true

> I get the same error trying to load an arbitrary file:
> 
>  >> $SAFE=1
> => 1
>  >> require 'testing'
> SecurityError: Insecure operation - require
>         from (irb):2:in `require'
>         from (irb):2
>         from /usr/local/ruby/1.9/bin/irb:12:in `<main>'

The same is true requiring arbitrary files - if I use the full path 
rather than relying on the load paths, I don't get the security error:

 >> $SAFE=1
=> 1
 >> require '/home/testuser/testing.rb'
=> true

Should Ruby 1.9 behave the same when requiring files using a full path 
than when relying on the load paths?

Regards,

Phil