From: Dave Fayram <kirindave@...>
Date: 2003-08-13T03:01:50+09:00
Subject: Re: $SAFE = 5 and Safe Ruby Misleading?

djd15@cwru.edu wrote:
> $SAFE allows you to contain malicious code and
> keep it from damaging the system, but if you allow
> code to be passed out to a trusted environment,
> then I think the burden would be on you to make
> sure somehow that the object isn't malicious (not
> that that's even possible, like you've said).
> 
> It seems to me that what you're asking would take
> a very complex security system (Java's system is
> quite complex and it doesn't get it right), and
> I don't think $SAFE was designed to cover it.

Yeah. There is no way to check. Further, there is no way to even be sure your
data from even a simple case is secure? Pass out a string? No, that won't
work, they overrided =~. Badness. A hash is just as  bad. It's almost
impossiboe to detect a really devious person doing this, since they could
uncode and execute highly obfuscated strings. 

Which is why I'm curious what $SAFE = 4 is meant to do? It's easy to make it
so that code runs in a box, what's difficult is to get data out of that box.

The only solution I can think of is for an object's methods and class methods
to be frozen (no aliasing, no adding, no removing) but its variables still be
mutable. With that constraint, with some care you could write a Ruby program
that could execute totally untrusted code and return meaninful values from it.


-- 
Dave Fayram
  kirindave@lensmen.net
Developer / Idealist
--