From: Teague Sheridan <teague@...>
Date: 2002-04-30T13:06:36+09:00
Subject: re: Security bug in load()

On Mon, 29 Apr 2002 18:49:43, Yukihiro Matsumoto wrote:
>
>|The manual claims this is possible.  However, the code in the manual
>|fails, and I'm afraid I must use some other scripting system (!).  I
>|have Ruby 1.6.7 installed, on Win98.
>
>The loading path should be absolute when you want to load in the
>sandbox.  The message is confusing.  It will be fixed.
>


Thanks for the quick reply.  However, it still does not work :(  I'm
hesitant to use a $SAFE of 2, since it would still be possible for a
script to modify the environment I create for it.


E:\code\ft\client> type b.rb
fileName = "e:/code/ft/client/hellomsg.rb"
f = open(fileName, "w")
f.print "puts 'Hi'\n"
f.close
puts fileName.tainted?
load(fileName, true)
Thread.start {
  $SAFE = 4
  load(fileName, true)
}.join


E:\code\ft\client> ruby b.rb
false
Hi
b.rb:9:in `load': loading from unsafe file e:/code/ft/client/hellomsg.rb
(Securi
tyError)
        from b.rb:7:in `join'
        from b.rb:7



The problem seems to be in path_check_1().  It's compatible only with
*nix (it even has the directory separator hardcoded to '/').  Under
Win95/98, st_mode from stat() will always indicate that a local
directory is world-writable, so this function will always return 0, and
the is_absolute_path check will always raise an error.

Changing path_check_1 to always return a 1 under DOSISH systems fixed
the problem.  I don't know how else to do it so that it can handle
network mappings, where stat() might return something more useful-- in
that regard, Windows itself is broken.  But without this change, or
something similar, I don't see how else to get load() to work properly
in Windows for a $SAFE of 4.

I do wonder why the console is an unsafe target for puts though ;) 
Won't need it for my scripting but it's a strange restriction.


E:\code\ft\client>ruby b.rb
false
Hi
e:/code/ft/client/hellomsg.rb:1:in `write': Insecure operation `write'
at level
4 (SecurityError)
        from b.rb:7:in `join'
        from b.rb:7



Thanks,
Teague