From: Phillip Gawlowski <cmdjackryan@...>
Date: 2011-06-18T12:19:45+09:00
Subject: Re: RFC - One word alias for require_relative

2011/6/18 David Masover <ninja@slaphack.com>:
>
> This isn't even particularly far-fetched. I realize it doesn't apply to you,
> being on Windows and all, but this is a use case Ruby fits particularly well.

This can apply to Windows, too, but it a) is limited to the current
user context (no setuid root idiocy here!), and b) would take the form
of malicious DLLs, rather than scripts.

For example:

Alice creates a neat, useful app and, nice as Alice is, she includes a
version sqlite.dll in her app's root directory. You install the app,
and launch it. Ruby requests the sqlite.dll, and Windows goes looking
for it, starting in ".".

Unfortunately, Alice was lying about being nice, and this DLL is now
downloading and installing a backdoor.

> By contrast, requiring relative to the current file isn't dangerous at all.

Well, *less* dangerous. There's always a risk associated with loading
external data that isn't created by the user doing the requiring.

-- 
Phillip Gawlowski

A method of solution is perfect if we can forsee from the start,
and even prove, that following that method we shall attain our aim.
               -- Leibnitz