From: Kirk Haines <wyhaines@...>
Date: 2010-09-22T02:22:58+09:00
Subject: Re: Ruby-based data language

On Tue, Sep 21, 2010 at 9:59 AM, Intransition <transfire@gmail.com> wrote:

> So now the question: is $SAFE=4 safe enough? My gut says no. Even
> though the above works, I think ultimately a true data format is
> desirable for most needs, such as configuration files. I think Ruby
> has a very nice syntax for it. Such a format would be to Ruby as JSON
> is to Javascript. And Ruby has a nice advantage with blocks.

Enough for what? To trust arbitrary configurations that are executable Ruby?

Trans, if you go way way back in the archives, you'll find a longish
running series of posts between Guy Decoux and a few other people
about $SAFE=4 and various clever hacks to try to, with Ruby, create an
environment that was truly safe. Guy showed in that typically terse,
let-my-code-speak-for-me way that he had, that every very clever Ruby
approach that was conceived of could also be circumvented.

The only way to have a "Ruby" data format that can contain executable
Ruby is to do something like what _Why did with his sandbox (which,
IIRC, came about in part because of this thread involving Guy) -- it
has to be supported at a very low level in the language.

You could create a Ruby-like format that is itself simply interpreted,
and if that's what you are talking about, I'd say go for it. But the
moment you allow anything in that format to be executed _as_Ruby_ you
can no longer trust arbitrary configurations.


Kirk Haines