From: ts <decoux@...>
Date: 2004-05-12T22:40:09+09:00
Subject: Re: safe eval?

>>>>> "F" == Florian Gross <flgr@ccan.de> writes:

F> Try this fixed version:

 I really don't know if I must post this :-(


svg% ls b.rb x.rb
ls: x.rb: No such file or directory
b.rb*
svg% 

svg% cat b.rb
#!/usr/bin/ruby
module Safe
   extend self

   def safe(code, sandbox=nil)
     error, result = nil, nil

     begin
       thread = Thread.new do
         sandbox ||= Object.new.taint
         yield(sandbox) if block_given?

         $-w = nil
         $SAFE = 5

         eval(code, sandbox.send(:binding))
       end
       result = secure_object(thread.value)
     rescue Exception => error
       error = secure_object(error)
     end

     return result, error
   end

   def secure_object(obj)
     immediate_classes = [Fixnum, Symbol, NilClass, TrueClass,
       FalseClass]
     return obj if immediate_classes.any? { |klass| klass === obj }
     safe_dup = Object.instance_method(:dup).bind(obj)
     safe_dup.call
   end
end

def safe(*args, &block)
   Safe.safe(*args, &block)
end

b = safe('
class << s = "`mv b.rb x.rb`"
   def call
   end
end
a = Object.new
ObjectSpace.define_finalizer(a, s)
a
')
svg% 

svg% b.rb
svg% 

svg% ls b.rb x.rb
ls: b.rb: No such file or directory
x.rb*
svg% 




Guy Decoux