evalhook 0.1.0 → 0.1.1

data/CHANGELOG

@@ -1,3 +1,5 @@
+0.1.1	Fixed ruby injection flaw in evalhook trick
+
 0.1.0	Created RDOC
 		
 		Implemented use examples

data/Rakefile

@@ -6,7 +6,7 @@ require 'rake/gempackagetask'
 
 spec = Gem::Specification.new do |s|
   s.name = 'evalhook'
-  s.version = '0.1.0'
+  s.version = '0.1.1'
   s.author = 'Dario Seminara'
   s.email = 'robertodarioseminara@gmail.com'
   s.platform = Gem::Platform::RUBY

data/ext/evalhook_base/evalhook_base.c

@@ -630,6 +630,18 @@ VALUE caller_obj(VALUE self, VALUE rblevel) {
 }
 
 
+VALUE validate_syntax(VALUE self, VALUE code) {
+
+	NODE* node = rb_compile_string("(eval)", code, 1);
+
+	if (node == 0) {
+		rb_raise(rb_eSyntaxError,"");
+	}
+
+	return Qnil;
+}
+
+
 extern void Init_evalhook_base() {
 	m_EvalHook = rb_define_module("EvalHook");
 
@@ -662,6 +674,7 @@ See README for more examples
 	c_HookHandler = rb_define_class_under(m_EvalHook, "HookHandler", rb_cObject);
 
 	rb_define_singleton_method(m_EvalHook, "hook_block", hook_block, 1);
+	rb_define_singleton_method(m_EvalHook, "validate_syntax", validate_syntax, 1);
 
 	rb_define_method(c_HookHandler, "hook_method_tree", hook_method_tree, 1);
 

data/lib/evalhook.rb

@@ -184,6 +184,8 @@ module EvalHook
 
       EvalHook.method_handler = self
 
+      EvalHook.validate_syntax args[0]
+
       args[0] = "
         retvalue = nil
         EvalHook.double_run do |run|

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: evalhook
 version: !ruby/object:Gem::Version 
-  hash: 27
+  hash: 25
   prerelease: false
   segments: 
   - 0
   - 1
-  - 0
-  version: 0.1.0
+  - 1
+  version: 0.1.1
 platform: ruby
 authors: 
 - Dario Seminara
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-10-30 00:00:00 -03:00
+date: 2010-12-19 00:00:00 -03:00
 default_executable: 
 dependencies: []