From: ts <decoux@...>
Date: 2004-05-11T19:24:39+09:00
Subject: Re: safe eval?

>>>>> "F" == Florian Gross <flgr@ccan.de> writes:

F> Just use this:

svg% cat b.rb
#!/usr/bin/ruby
module Safe; end
class << Safe
   def safe(code, sandbox=nil)
     error = nil

     begin
       thread = Thread.new {
         $-w = nil

         sandbox ||= Object.new.taint

         yield(sandbox) if block_given?

         $SAFE = 5
         eval(code, sandbox.send(:binding))
       }
       value = thread.value
       result = Marshal.load(Marshal.dump(thread.value))
     rescue Exception => error
       error = Marshal.load(Marshal.dump(error))
     end

     return result, error
   end
end

def safe(*args, &block)
   Safe::safe(*args, &block)
end

safe('
class << a = []
   def _dump(a)
      $stderr.puts "More you make it complex, more it will be easy to break"
   end
end
a')
svg% 


Guy Decoux