From: matz@... (Yukihiro Matsumoto)
Date: 2003-10-30T09:28:09+09:00
Subject: Re: [BUG] system() isn't safe on win32

Hi,

In message "[BUG] system() isn't safe on win32"
    on 03/10/30, Florian Gross <flgr@ccan.de> writes:

|This ruby one-liner
|
|   ruby -ve "$SAFE = 5; system 'echo Was able to run an arbitrary command
|   in safe mode.'"
|
|produces this scary result:
|
|   ruby 1.8.0 (2003-08-04) [i386-mswin32]
|   Was able to run an arbitrary command in safe mode.
|
|IMHO this effectively disables all the security which $SAFE ought to 
|give you and should be fixed in the ruby interpreter.

It shouldn't happen.  Does anyone confirm this?

How did you invoke ruby?  From cmd.exe or Cygwin bash?
The only reasonable explanation I can think of now is:

  using bash (or any other UNIXish shell)
  have environment variables named SAFE,
  which value looks like valid identifier

In this case,

   ruby -ve '$SAFE = 5; system "echo Was able to run an arbitrary command in safe mode."'

(note exchanged ' and ") should work.  But there might be other reasons.

							matz.