From: James Edward Gray II <james@...>
Date: 2011-01-11T23:44:44+09:00
Subject: Re: DATA.seek allows to read file

On Jan 11, 2011, at 4:55 AM, Caius Durling wrote:

> On 11 Jan 2011, at 09:03, Robert Klemme wrote:
> 
>> In other words, I can read what's before __END__ if I simply seek.
>> IMHO that is a bad thing and may even be used for attacks.

I love the feature.  It's one of those fun things to abuse.  :)

> I've written a script in the past that (ab)used that to use DATA as a small datastore…

I've done that too.  :)

> rather than writing out to a separate data file. I had to write out the entire file though, including the source code…

You don't have to rewrite the code, if you are careful:

  #!/usr/bin/env ruby -wKU

  pos = DATA.pos  # memorize position after __END__

  # do whatever
  count = DATA.read.to_i
  puts "Count:  #{count}"
  count += 1

  DATA.reopen(__FILE__, "a+")  # turn on writing mode
  DATA.truncate(pos)           # remove the DATA section
  DATA.puts count              # update DATA

  __END__
  0

James Edward Gray II