From: "Ara.T.Howard" <ahoward@...>
Date: 2004-05-13T00:43:54+09:00
Subject: Re: safe eval?

On Wed, 12 May 2004, ts wrote:

> >>>>> "F" == Florian Gross <flgr@ccan.de> writes:
> 
> F> Try this fixed version:
> 
>  I really don't know if I must post this :-(

yes, you must!

what do you do with your spare time guy!?  watch out or a man in black wearing
dark glasses is going to knock on your door...  ;-)

all this makes me start to think that i really must use a racc parser....
uggh

-a

> 
> 
> svg% ls b.rb x.rb
> ls: x.rb: No such file or directory
> b.rb*
> svg% 
> 
> svg% cat b.rb
> #!/usr/bin/ruby
> module Safe
>    extend self
> 
>    def safe(code, sandbox=nil)
>      error, result = nil, nil
> 
>      begin
>        thread = Thread.new do
>          sandbox ||= Object.new.taint
>          yield(sandbox) if block_given?
> 
>          $-w = nil
>          $SAFE = 5
> 
>          eval(code, sandbox.send(:binding))
>        end
>        result = secure_object(thread.value)
>      rescue Exception => error
>        error = secure_object(error)
>      end
> 
>      return result, error
>    end
> 
>    def secure_object(obj)
>      immediate_classes = [Fixnum, Symbol, NilClass, TrueClass,
>        FalseClass]
>      return obj if immediate_classes.any? { |klass| klass === obj }
>      safe_dup = Object.instance_method(:dup).bind(obj)
>      safe_dup.call
>    end
> end
> 
> def safe(*args, &block)
>    Safe.safe(*args, &block)
> end
> 
> b = safe('
> class << s = "`mv b.rb x.rb`"
>    def call
>    end
> end
> a = Object.new
> ObjectSpace.define_finalizer(a, s)
> a
> ')
> svg% 
> 
> svg% b.rb
> svg% 
> 
> svg% ls b.rb x.rb
> ls: b.rb: No such file or directory
> x.rb*
> svg% 
> 
> 
> 
> 
> Guy Decoux
> 
> 
> 

-- 
===============================================================================
| EMAIL   :: Ara [dot] T [dot] Howard [at] noaa [dot] gov
| PHONE   :: 303.497.6469
| ADDRESS :: E/GC2 325 Broadway, Boulder, CO 80305-3328
| URL     :: http://www.ngdc.noaa.gov/stp/
| TRY     :: for l in ruby perl;do $l -e "print \"\x3a\x2d\x29\x0a\"";done 
===============================================================================