summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authormame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2009-08-04 16:44:05 +0000
committermame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2009-08-04 16:44:05 +0000
commit528574c2e21e25fe1f848f77f4e7606636a7a2dc (patch)
tree8a1c4326493d9bbf2af4289dcce642700ed0edf9
parent5ea7e7f60b2c8393cc2a034aabd874768b32807c (diff)
* lib/pp.rb (guard_inspect_key): untrust internal hash to prevent
unexpected SecurityError. * test/ruby/test_object.rb: add a test for [ruby-dev:38982]. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@24396 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--ChangeLog7
-rw-r--r--lib/pp.rb6
-rw-r--r--test/ruby/test_object.rb36
3 files changed, 46 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index 8066675..e5e198d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Wed Aug 5 01:38:27 2009 Yusuke Endoh <mame@tsg.ne.jp>
+
+ * lib/pp.rb (guard_inspect_key): untrust internal hash to prevent
+ unexpected SecurityError.
+
+ * test/ruby/test_object.rb: add a test for [ruby-dev:38982].
+
Wed Aug 5 00:33:05 2009 Nobuyoshi Nakada <nobu@ruby-lang.org>
* lib/rdoc/parser/c.rb: fixed a small error in the documentation.
diff --git a/lib/pp.rb b/lib/pp.rb
index e28875c..a71ce9d 100644
--- a/lib/pp.rb
+++ b/lib/pp.rb
@@ -107,17 +107,17 @@ class PP < PrettyPrint
module PPMethods
def guard_inspect_key
if Thread.current[:__recursive_key__] == nil
- Thread.current[:__recursive_key__] = {}
+ Thread.current[:__recursive_key__] = {}.untrust
end
if Thread.current[:__recursive_key__][:inspect] == nil
- Thread.current[:__recursive_key__][:inspect] = {}
+ Thread.current[:__recursive_key__][:inspect] = {}.untrust
end
save = Thread.current[:__recursive_key__][:inspect]
begin
- Thread.current[:__recursive_key__][:inspect] = {}
+ Thread.current[:__recursive_key__][:inspect] = {}.untrust
yield
ensure
Thread.current[:__recursive_key__][:inspect] = save
diff --git a/test/ruby/test_object.rb b/test/ruby/test_object.rb
index 51a3cdc..eff463f 100644
--- a/test/ruby/test_object.rb
+++ b/test/ruby/test_object.rb
@@ -413,4 +413,40 @@ class TestObject < Test::Unit::TestCase
assert_equal(true, s.untrusted?)
assert_equal(true, s.tainted?)
end
+
+ def test_exec_recursive
+ Thread.current[:__recursive_key__] = nil
+ a = [[]]
+ a.inspect
+
+ assert_nothing_raised do
+ -> do
+ $SAFE = 4
+ begin
+ a.hash
+ rescue ArgumentError
+ end
+ end.call
+ end
+
+ -> do
+ assert_nothing_raised do
+ $SAFE = 4
+ a.inspect
+ end
+ end.call
+
+ -> do
+ o = Object.new
+ def o.to_ary(x); end
+ def o.==(x); $SAFE = 4; false; end
+ a = [[o]]
+ b = []
+ b << b
+
+ assert_nothing_raised do
+ b == a
+ end
+ end.call
+ end
end