From: Michael Granger <ged@...>
Date: 2002-04-19T07:45:39+09:00
Subject: Re: Object#send with $SAFE >= 1

On Thursday 18 April 2002 13:26, Jason Voegele wrote:

> Strange.  I tried your example in irb and got following error.  Perhaps my
> irb is broken?  A bug in Ruby?

[snip]

> irb(main):001:0> $SAFE = 1
> 1
> irb(main):002:0> class Foo; def foo; puts "foo!"; end; end
> SecurityError: Insecure operation - eval
>         from c:/dev/ruby/lib/ruby/1.6/irb/workspace.rb:80:in `eval'

This happens because IRB evals the string you type (ie., "class Foo; def foo; 
puts "foo!"; end; end") inside of IRB itself. Notice that the `eval' is in 
"c:/dev/ruby/lib/ruby/1.6/irb/workspace.rb:80". The same thing will happen 
for nearly anything you do in IRB after setting $SAFE = 1:

irb(main):001:0> $SAFE = 1
1
irb(main):002:0> p RUBY_VERSION
SecurityError: Insecure operation - eval
        from /usr/lib/ruby/1.7/irb/workspace.rb:81:in `eval'
        from /usr/lib/ruby/1.7/irb/workspace.rb:81:in `evaluate'
        from /usr/lib/ruby/1.7/irb/context.rb:261:in `evaluate'
        from /usr/lib/ruby/1.7/irb.rb:145:in `eval_input'
        from /usr/lib/ruby/1.7/irb.rb:145:in `trace_in'
        from /usr/lib/ruby/1.7/irb.rb:145:in `eval_input'
        from /usr/lib/ruby/1.7/irb.rb:142:in `signal_status'
        from /usr/lib/ruby/1.7/irb.rb:142:in `eval_input'
        from /usr/lib/ruby/1.7/irb.rb:140:in `each_top_level_statement'
        from /usr/lib/ruby/1.7/irb/ruby-lex.rb:243:in `loop'
        from /usr/lib/ruby/1.7/irb/ruby-lex.rb:243:in 
`each_top_level_statement'
        from /usr/lib/ruby/1.7/irb/ruby-lex.rb:216:in `catch'
        from /usr/lib/ruby/1.7/irb/ruby-lex.rb:216:in 
`each_top_level_statement'
        from /usr/lib/ruby/1.7/irb.rb:140:in `eval_input'
        from /usr/lib/ruby/1.7/irb.rb:71:in `start'
        from /usr/lib/ruby/1.7/irb.rb:70:in `catch'
        from /usr/lib/ruby/1.7/irb.rb:70:in `start'
        from /usr/bin/irb:13Maybe IRB bug!!


-- 
Michael Granger <ged@FaerieMUD.org>
Rubymage, Believer, Architect
The FaerieMUD Consortium <http://www.FaerieMUD.org/>