From: ts <decoux@...>
Date: 2003-01-10T19:19:28+09:00
Subject: Re: Security problems

>>>>> "T" == Tim Bates <tim@bates.id.au> writes:

T> The problem is that with $SAFE == 4, it doesn't allow the robot programmer to 
T> create new classes ("SecurityError: Insecure: can't set constant"), and I 
T> can't just create the class for them first and give it to them to modify 
T> either ("SecurityError: extending class prohibited")

 Can you work with singleton methods ? Something like this

pigeon% cat b.rb
#!/usr/bin/ruby
module M
   class A
   end
end
$SAFE = 4
a = M::A::new
def a.run
   puts "run"
end
a.run
pigeon% 

pigeon% b.rb
./b.rb:10:in `write': Insecure operation `write' at level 4 (SecurityError)
        from ./b.rb:10:in `puts'
        from ./b.rb:10:in `run'
        from ./b.rb:12
pigeon% 

 Create *only* the class in non-safe mode after verification


Guy Decoux