[#399938] how to read arrary with an array — "Richard D." <lists@...>

Hello. I believe this is basic question, but I'm just starting to learn

19 messages 2012/10/02

[#400050] img src while sending email ruby cgi — Ferdous ara <lists@...>

Hi

16 messages 2012/10/05

[#400351] Drop 1st and last particular character — ajay paswan <lists@...>

What is the most efficient way to drop '#' from the first place and last

15 messages 2012/10/16

[#400374] database part of a desktop application — "Sebastjan H." <lists@...>

Hi,

14 messages 2012/10/16
[#400375] Re: database part of a desktop application — Chad Perrin <code@...> 2012/10/16

On Wed, Oct 17, 2012 at 05:28:39AM +0900, Sebastjan H. wrote:

[#400377] Re: database part of a desktop application — sto.mar@... 2012/10/17

Am 16.10.2012 23:24, schrieb Chad Perrin:

[#400389] Re: database part of a desktop application — Chad Perrin <code@...> 2012/10/17

On Wed, Oct 17, 2012 at 01:39:21PM +0900, sto.mar@web.de wrote:

[#400386] Unable to send attachment, and dealing with multiple attachment — ajay paswan <lists@...>

Hi,

11 messages 2012/10/17

[#400454] Hash with Integer key issue — Wayne Simmerson <lists@...>

Hi Im new to Ruby and am getting some unexpected results from a

18 messages 2012/10/19

[#400535] Name/symbol/object type clash? What is happening here? — Todd Benson <caduceass@...>

It's nonsense code, but I'm curious as to what is going on behind the scenes...

41 messages 2012/10/23

[#400556] Calling a method foo() or an object foo.method_call_here - both — Marc Heiler <lists@...>

Hello.

13 messages 2012/10/24

[#400650] OpenSSL ECDSA public key from private — Nokan Emiro <uzleepito@...>

Hi,

11 messages 2012/10/27

[#400680] Passing folder as argument ARGV? — Joz Private <lists@...>

Is there an easy way to pass multiple files on the command line?

15 messages 2012/10/28
[#400681] Re: Passing folder as argument ARGV? — brad smith <bradleydsmith@...> 2012/10/28

How are you traversing the directory you pass in on the command line ?

[#400697] File.readable? and /proc — Jeff Moore <lists@...>

root@nail:/projects/proc_fs# uname -a

13 messages 2012/10/28

[#400714] Marshal.load weird issue — "Pierre J." <lists@...>

Hi guys

12 messages 2012/10/28

[#400781] bug?: local variable created in if modifier not available in modified expression — "Mean L." <lists@...>

irb(main):001:0> local1 if local1 = "created"

21 messages 2012/10/30
[#400807] Re: bug?: local variable created in if modifier not available in modified expression — Bartosz Dziewoński <matma.rex@...> 2012/10/31

Oh, and in case it wasn't apparent: you can just add

[#400808] Re: bug?: local variable created in if modifier not available in modified expression — Eliezer Croitoru <eliezer@...> 2012/10/31

On 10/31/2012 4:52 PM, Bartosz Dziewoナгki wrote:

[#400809] Re: bug?: local variable created in if modifier not available in modified expression — Robert Klemme <shortcutter@...> 2012/10/31

On Wed, Oct 31, 2012 at 4:28 PM, Eliezer Croitoru <eliezer@ngtech.co.il>wrote:

[#400784] REXML & HTMLentities incorrectly map to UTF-8 — "Mark S." <lists@...>

I have some XML data (UTF 8) that I'm trying to convert into another XML

13 messages 2012/10/30

Re: is an untrusted binding that does not close over anything, in practice trusted

From: "Mean L." <lists@...>
Date: 2012-10-14 17:48:23 UTC
List: ruby-talk #400321
Robert Klemme wrote in post #1079785:
> On Sun, Oct 14, 2012 at 11:28 AM, Mean L. <lists@ruby-forum.com> wrote:
>> def context_binding
>>   @context.instance_eval {binding}
>> end
>>
>> def eval(str)
>>   ->{$SAFE = 4; context_binding.eval(str)}.()
>> end
>>
>> the binding context is unsafe since it's constructed in the sandbox
>
> What exactly do you mean by "safe" here?  Can you be more specific
> what you mean by "safety" here and what you are trying to accomplish?
>

I meant to use the term (un)trusted. The concept of trust is well 
defined in ruby. (untrusted code not being to modify trusted objects. 
Object#untrused?).

So, to clarify and expand, my biding is untrusted because it's 
constructed in the $SAFE=4 sandbox.  Which means the untrusted sandbox 
code can modify it.  So the question is, am I correct that in my usage, 
the binding does not close over anything (other than self which refers 
to a trusted object) so does not allow to modify anything, which in 
effect makes it as if trusted.

>> but since it appears to not close over anything other than self
>> (@context) which is safe, is it then effectively safe?
>
> The safety of the whole thing depends on str's tainted status it
> seems.  Also, since you are not executing the code in its own thread
> you create a side effect with your change of $SAFE.  The usual
> solution to this is to use $SAFE in another thread.  You could do
>
> def e(str)
>   Thread.new do
>     $SAFE  = 4
>     context_binding.eval(str)
>   end.value
> end
>
> This wastes a single thread but doesn't actually execute in parallel
> because via Thread#value the caller thread blocks until the other
> thread has finished.  And you do not change the $SAFE status of the
> caller which IMHO is a bad side effect to have.

Here's what "programming ruby" says about that:

"The safe level
may be set during the execution of a proc object without affecting the 
safe level of the code that
invoked that proc."

Experimentally that appears to be true.  $SAFE remains 0 after the 
lambda runs.

-- 
Posted via http://www.ruby-forum.com/.

In This Thread