Warn on access/modify of $SAFE, and remove effects of modifying $SAFE

This removes the security features added by $SAFE = 1, and warns for access
or modification of $SAFE from Ruby-level, as well as warning when calling
all public C functions related to $SAFE.

This modifies some internal functions that took a safe level argument
to no longer take the argument.

rb_require_safe now warns, rb_require_string has been added as a
version that takes a VALUE and does not warn.

One public C function that still takes a safe level argument and that
this doesn't warn for is rb_eval_cmd.  We may want to consider
adding an alternative method that does not take a safe level argument,
and warn for rb_eval_cmd.

3 files changed, 115 insertions, 114 deletions

diff --git a/spec/ruby/language/predefined_spec.rb b/spec/ruby/language/predefined_spec.rb
index 90ea8c6bb1..cec6bc852c 100644
--- a/spec/ruby/language/predefined_spec.rb
+++ b/spec/ruby/language/predefined_spec.rb
@@ -771,8 +771,6 @@ __LINE__         String          The current line number in the source file. [r/
 $LOAD_PATH       Array           A synonym for $:. [r/o]
 $-p              Object          Set to true if the -p option (which puts an implicit while gets . . . end
                                  loop around your program) is present on the command line. [r/o]
-$SAFE            Fixnum          The current safe level. This variable’s value may never be
-                                 reduced by assignment. [thread] (Not implemented in Rubinius)
 $VERBOSE         Object          Set to true if the -v, --version, -W, or -w option is specified on the com-
                                  mand line. Set to false if no option, or -W1 is given. Set to nil if -W0
                                  was specified. Setting this option to true causes the interpreter and some
diff --git a/spec/ruby/language/safe_spec.rb b/spec/ruby/language/safe_spec.rb
index be150df9d1..53ab4f9561 100644
--- a/spec/ruby/language/safe_spec.rb
+++ b/spec/ruby/language/safe_spec.rb
@@ -1,137 +1,138 @@
 require_relative '../spec_helper'
 
 describe "The $SAFE variable" do
-
-  ruby_version_is "2.6" do
-    after :each do
-      $SAFE = 0
+  ruby_version_is ""..."2.7" do
+    ruby_version_is "2.6" do
+      after :each do
+        $SAFE = 0
+      end
     end
-  end
 
-  it "is 0 by default" do
-    $SAFE.should == 0
-    proc {
+    it "is 0 by default" do
       $SAFE.should == 0
-    }.call
-  end
+      proc {
+        $SAFE.should == 0
+      }.call
+    end
 
-  it "can be set to 0" do
-    proc {
-      $SAFE = 0
-      $SAFE.should == 0
-    }.call
-  end
+    it "can be set to 0" do
+      proc {
+        $SAFE = 0
+        $SAFE.should == 0
+      }.call
+    end
 
-  it "can be set to 1" do
-    proc {
-      $SAFE = 1
-      $SAFE.should == 1
-    }.call
-  end
+    it "can be set to 1" do
+      proc {
+        $SAFE = 1
+        $SAFE.should == 1
+      }.call
+    end
 
-  [2, 3, 4].each do |n|
-    it "cannot be set to #{n}" do
+    [2, 3, 4].each do |n|
+      it "cannot be set to #{n}" do
+        -> {
+          proc {
+            $SAFE = n
+          }.call
+        }.should raise_error(ArgumentError, /\$SAFE=2 to 4 are obsolete/)
+      end
+    end
+
+    ruby_version_is ""..."2.6" do
+      it "cannot be set to values below 0" do
+        -> {
+          proc {
+            $SAFE = -100
+          }.call
+        }.should raise_error(SecurityError, /tried to downgrade safe level from 0 to -100/)
+      end
+    end
+
+    ruby_version_is "2.6" do
+      it "raises ArgumentError when set to values below 0" do
+        -> {
+          proc {
+            $SAFE = -100
+          }.call
+        }.should raise_error(ArgumentError, "$SAFE should be >= 0")
+      end
+    end
+
+    it "cannot be set to values above 4" do
       -> {
         proc {
-          $SAFE = n
+          $SAFE = 100
         }.call
       }.should raise_error(ArgumentError, /\$SAFE=2 to 4 are obsolete/)
     end
-  end
 
-  ruby_version_is ""..."2.6" do
-    it "cannot be set to values below 0" do
-      -> {
+    ruby_version_is ""..."2.6" do
+      it "cannot be manually lowered" do
         proc {
-          $SAFE = -100
+          $SAFE = 1
+          -> {
+            $SAFE = 0
+          }.should raise_error(SecurityError, /tried to downgrade safe level from 1 to 0/)
         }.call
-      }.should raise_error(SecurityError, /tried to downgrade safe level from 0 to -100/)
-    end
-  end
+      end
 
-  ruby_version_is "2.6" do
-    it "raises ArgumentError when set to values below 0" do
-      -> {
+      it "is automatically lowered when leaving a proc" do
+        $SAFE.should == 0
         proc {
-          $SAFE = -100
+          $SAFE = 1
         }.call
-      }.should raise_error(ArgumentError, "$SAFE should be >= 0")
-    end
-  end
-
-  it "cannot be set to values above 4" do
-    -> {
-      proc {
-        $SAFE = 100
-      }.call
-    }.should raise_error(ArgumentError, /\$SAFE=2 to 4 are obsolete/)
-  end
+        $SAFE.should == 0
+      end
 
-  ruby_version_is ""..."2.6" do
-    it "cannot be manually lowered" do
-      proc {
-        $SAFE = 1
+      it "is automatically lowered when leaving a lambda" do
+        $SAFE.should == 0
         -> {
-          $SAFE = 0
-        }.should raise_error(SecurityError, /tried to downgrade safe level from 1 to 0/)
-      }.call
+          $SAFE = 1
+        }.call
+        $SAFE.should == 0
+      end
     end
 
-    it "is automatically lowered when leaving a proc" do
-      $SAFE.should == 0
-      proc {
+    ruby_version_is "2.6" do
+      it "can be manually lowered" do
         $SAFE = 1
-      }.call
-      $SAFE.should == 0
-    end
+        $SAFE = 0
+        $SAFE.should == 0
+      end
 
-    it "is automatically lowered when leaving a lambda" do
-      $SAFE.should == 0
-      -> {
+      it "is not Proc local" do
+        $SAFE.should == 0
+        proc {
+          $SAFE = 1
+        }.call
+        $SAFE.should == 1
+      end
+
+      it "is not lambda local" do
+        $SAFE.should == 0
+        -> {
+          $SAFE = 1
+        }.call
+        $SAFE.should == 1
+      end
+
+      it "is global like regular global variables" do
+        Thread.new { $SAFE }.value.should == 0
         $SAFE = 1
-      }.call
-      $SAFE.should == 0
+        Thread.new { $SAFE }.value.should == 1
+      end
     end
-  end
 
-  ruby_version_is "2.6" do
-    it "can be manually lowered" do
-      $SAFE = 1
-      $SAFE = 0
-      $SAFE.should == 0
+    it "can be read when default from Thread#safe_level" do
+      Thread.current.safe_level.should == 0
     end
 
-    it "is not Proc local" do
-      $SAFE.should == 0
+    it "can be read when modified from Thread#safe_level" do
       proc {
         $SAFE = 1
+        Thread.current.safe_level.should == 1
       }.call
-      $SAFE.should == 1
     end
-
-    it "is not lambda local" do
-      $SAFE.should == 0
-      -> {
-        $SAFE = 1
-      }.call
-      $SAFE.should == 1
-    end
-
-    it "is global like regular global variables" do
-      Thread.new { $SAFE }.value.should == 0
-      $SAFE = 1
-      Thread.new { $SAFE }.value.should == 1
-    end
-  end
-
-  it "can be read when default from Thread#safe_level" do
-    Thread.current.safe_level.should == 0
-  end
-
-  it "can be read when modified from Thread#safe_level" do
-    proc {
-      $SAFE = 1
-      Thread.current.safe_level.should == 1
-    }.call
   end
 end
diff --git a/spec/ruby/optional/capi/string_spec.rb b/spec/ruby/optional/capi/string_spec.rb
index 1cfd590ca4..53d28f7940 100644
--- a/spec/ruby/optional/capi/string_spec.rb
+++ b/spec/ruby/optional/capi/string_spec.rb
@@ -558,20 +558,22 @@ describe "C-API String function" do
   end
 
   describe "SafeStringValue" do
-    it "raises for tained string when $SAFE is 1" do
-      begin
-        Thread.new {
-          $SAFE = 1
-          -> {
-            @s.SafeStringValue("str".taint)
-          }.should raise_error(SecurityError)
-        }.join
-      ensure
-        $SAFE = 0
+    ruby_version_is ''...'2.7' do
+      it "raises for tained string when $SAFE is 1" do
+        begin
+          Thread.new {
+            $SAFE = 1
+            -> {
+              @s.SafeStringValue("str".taint)
+            }.should raise_error(SecurityError)
+          }.join
+        ensure
+          $SAFE = 0
+        end
       end
-    end
 
-    it_behaves_like :string_value_macro, :SafeStringValue
+      it_behaves_like :string_value_macro, :SafeStringValue
+    end
   end
 
   describe "rb_str_modify_expand" do