flavour_saver 4.0.0 → 4.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 479bb662042e1b7168a3a7db7b34094fc0e66c9a9da64240d4c1117e61345409
-  data.tar.gz: 98d44dd0115bd00a2bf122f70602cab8854b7770f7513703ce0af606ac9c8bf9
+  metadata.gz: 453d625c7c8aad7ed0a3a06d21d482e92212e252e3a3e0624c825561cb117193
+  data.tar.gz: 2bae35d9e7f9c4330d93d4dbfdf72c2fb4d0ce09f660f9f80d78ff8095b249b0
 SHA512:
-  metadata.gz: efeeb00e64f30bf3433f801b849cbfcfea494fd202a79823d680f7b38a6191d06c8b7fe5e2e6c55511bfb003ef9b71defd2b4ca00beb4a92d2d7eb5112b96122
-  data.tar.gz: cf8d25967ac70181240e964cfab1018a371263f17db5ca2f251af87070e2db9dd16b1b68d4ff44b6f49fdc9c94fcc19e20e971f558e2c6fa86178aa740a522a3
+  metadata.gz: cab9b8e280389ec12e1dbb227698bb52e9ca30859fdb15103db7b5c35f7263e3d8355e05c94d364cda7d7278c7850155ac66ac9ef2027e617bde6ecf0e7387e6
+  data.tar.gz: c0d6c23e01a6850863092c1829310589e1fd6503f8337be215ad308d3487464cecf74330b4a42c29c937576a70b1b3e1f3a2f514adadfa3679c873006e417749

data/CHANGELOG.md

@@ -7,6 +7,50 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## 4.0.1
+
+### Security
+
+* Fixed arbitrary code execution via template method dispatch
+  ([GHSA-98g2-gr9f-f85r](https://github.com/FlavourSaver/FlavourSaver/security/advisories/GHSA-98g2-gr9f-f85r)).
+  A bare Handlebars identifier was dispatched to the rendering context with
+  `public_send`, and Ruby's metaprogramming methods are public on every object, so a
+  template containing `{{instance_eval "..."}}` executed arbitrary Ruby in the host
+  process. Anyone able to author or edit a template could run code as the application.
+
+  **All releases up to and including 4.0.0 are affected.** The fix for OSVDB #110796
+  guarded dispatch with `respond_to?`. That never blocked public `Object` methods, so
+  `{{instance_eval "..."}}` was reachable before and after it, and it could be sidestepped
+  entirely with `{{send "system" "ls"}}`. It stopped `{{system "ls"}}` only for context
+  objects that report their methods honestly — against a proxy or delegator that
+  overreports `respond_to?`, that payload kept working in every release. This release is
+  what closes it.
+
+  Reported by Arpit Jain ([@arpitjain099](https://github.com/arpitjain099)).
+
+### Changed
+
+* Templates may now only dispatch to methods the application deliberately made
+  available: registered helpers, locals, FlavourSaver's own block helpers, and the
+  context object's own API. Anything else — Ruby's inherited object surface, methods
+  a framework has mixed into `Object`, and FlavourSaver's internal plumbing — raises
+  `FlavourSaver::ForbiddenMethodException`, a subclass of `UnknownHelperException`, so
+  existing rescue clauses continue to catch it.
+
+  Templates using `{{class}}`, `{{hash}}`, `{{method}}`, `{{display}}` and similar will
+  now raise instead of rendering. Such templates could not have been working correctly:
+  `Helpers::Decorator` inherits those methods, so its own implementation already shadowed
+  any same-named method on the context object — `{{hash}}` returned an object digest and
+  `{{display}}` printed the decorator to stdout rather than returning your data.
+
+  Context methods sharing a name with a *private* `Kernel` method — `format`, `open`,
+  `select`, `print`, `test`, `load` and around sixty others — are unaffected and continue
+  to dispatch as before.
+
+  To read a data field named after an `Object` method, use the segment literal syntax
+  (`{{[hash]}}`), which resolves through `Decorator#[]` and so needs a hash-like context,
+  or register an explicit helper.
+
 ## 4.0.0
 
 ### Added

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    flavour_saver (4.0.0)
+    flavour_saver (4.0.1)
       rltk (< 3.0)
       tilt (~> 2.6)
 

data/lib/flavour_saver/helpers.rb

@@ -92,7 +92,21 @@ module FlavourSaver
         # I would rather have it raise a NameError, but Moustache
         # compatibility requires that missing helpers return
         # nothing. A good place for bugs to hide.
-        @source.send(name, *args, &b) if @source.respond_to? name
+        #
+        # SECURITY: public_send here is load-bearing, not stylistic. Do not
+        # change it back to send.
+        #
+        # Private Kernel methods -- system, eval, exec, fork -- are deliberately
+        # not refused by Runtime#forbidden_method?, because refusing them would
+        # also refuse the ~60 context methods that share a name with one. They
+        # are safe because they cannot be reached: public_send skips them, so
+        # they arrive here, and this call skips them again.
+        #
+        # That makes this the only thing standing between a context that
+        # overreports respond_to? -- a proxy or delegator answering true to
+        # everything -- and arbitrary command execution. Reverting it to send
+        # reopens {{system "..."}} on such a context; verified, not theorised.
+        @source.public_send(name, *args, &b) if @source.respond_to? name
       end
     end
 

data/lib/flavour_saver/runtime.rb

@@ -6,6 +6,7 @@ module FlavourSaver
   InappropriateUseOfElseException   = Class.new(StandardError)
   UndefinedPrivateVariableException = Class.new(StandardError)
   UnknownHelperException            = Class.new(RuntimeError)
+  ForbiddenMethodException          = Class.new(UnknownHelperException)
   class Runtime
 
     attr_accessor :context, :parent, :ast, :privates
@@ -128,6 +129,9 @@ module FlavourSaver
       when LocalVarNode
         result = private_variable_get(call.name)
       else
+        if forbidden_method? context, call.name
+          raise ForbiddenMethodException, "Refusing to call #{call.name.inspect} from a template: it isn't a helper, a local, or part of the template context's own API. Register a helper if you meant to expose it, or use #{"{{[#{call.name}]}}"} to read a data field of that name."
+        end
         if call.parent.is_a? BlockExpressionNode and !context.respond_to? call.name
           raise UnknownHelperException, "Template context doesn't respond to method #{call.name.inspect}."
         end
@@ -239,6 +243,56 @@ module FlavourSaver
 
     private
 
+    # True unless +name+ resolves to something the application deliberately
+    # made available to templates.
+    #
+    # This is an allowlist of *owners* rather than a denylist of names, because
+    # a name denylist cannot be made complete. Object's inherited API is the
+    # obvious hazard (instance_eval, send, instance_exec), but it is not the
+    # whole of it: ActiveSupport mixes Object#try in from its own module and it
+    # forwards to public_send, and Decorator#method_missing is public and
+    # forwards to the context. Neither appears in Object.instance_methods.
+    #
+    # Only two things are legitimately dispatchable on the decorator itself:
+    # helpers and locals, which live on a module extended onto this runtime's
+    # decorator and so are absent from Decorator.ancestors; and FlavourSaver's
+    # own helpers, which Defaults owns. Everything else defined on the
+    # decorator is either Object's ambient surface or the decorator's internal
+    # plumbing, and neither is template surface.
+    #
+    # A name the decorator doesn't define at all raises NameError here, which
+    # means it will be delegated to the context object by method_missing --
+    # ordinary template dispatch, and allowed.
+    #
+    # Only *publicly* reachable names are refused. #method resolves private
+    # methods too, and refusing those as well would break every context method
+    # sharing a name with a private Kernel method -- format, open, select,
+    # print, test, load and some sixty others, all of which dispatch fine
+    # today. They aren't reachable through public_send in any case: they fall
+    # through to method_missing, which is guarded by its own use of
+    # public_send.
+    def forbidden_method?(context, name)
+      owner = begin
+                context.method(name).owner
+              rescue NameError
+                return false
+              end
+
+      return false if owner.equal? Helpers::Defaults
+      return false unless Helpers::Decorator.ancestors.include? owner
+
+      begin
+        context.singleton_class.public_method_defined? name
+      rescue TypeError
+        # Integer, Symbol and Float have no singleton class. A primitive can't
+        # carry a singleton method, so a name that resolved on one is
+        # necessarily inherited -- refuse it. Reached only if a primitive is
+        # ever passed here undecorated; the decorator wrapping in evaluate_call
+        # normally prevents that, but the predicate must be correct on its own.
+        true
+      end
+    end
+
     def escape(output)
       if output.respond_to?(:html_safe) && output.html_safe?
         # If the string is already marked as html_safe then don't

data/lib/flavour_saver/version.rb

@@ -1,3 +1,3 @@
 module FlavourSaver
-  VERSION = "4.0.0"
+  VERSION = "4.0.1"
 end

data/spec/acceptance/ensure_no_rce_spec.rb

@@ -1,26 +1,254 @@
 require 'tilt'
+require 'tmpdir'
+require 'fileutils'
+# Object#try is mixed into Object from ActiveSupport's own module and forwards
+# to public_send, so it is part of the surface under test here. Required
+# explicitly rather than relying on another spec file having loaded it.
+require 'active_support/core_ext/object/try'
 require 'flavour_saver'
 
-describe "Can't call methods that the context doesn't respond to" do
-  subject { Tilt.new(template).render(context).gsub(/[\s\r\n]+/, ' ').strip }
-  let(:template) { '{{system "ls"}}' }
-  let(:context)  { double(:context) }
+# These specs previously drove Tilt.new(template_string), which treats its
+# argument as a *filename*. It raised "No template engine registered for
+# {{system "ls"}}" before FlavourSaver was ever invoked, so both examples
+# passed without executing a single line of the runtime. Drive
+# FlavourSaver.evaluate directly so the dispatch path is actually exercised.
+describe "Template-driven method dispatch" do
+  # A plain object, to show the context needs nothing special to be exploitable.
+  let(:context) { Object.new }
 
-  it 'renders correctly' do
-    expect(Kernel).not_to receive(:system)
-    expect { subject }.to raise_error(RuntimeError)
+  def evaluate(template, ctx = context)
+    FlavourSaver.evaluate(template, ctx)
   end
-end
 
-describe "Can't eval arbitrary Ruby code" do
-  subject { Tilt.new(template).render(context).gsub(/[\s\r\n]+/, ' ').strip }
-  let(:template) { '{{eval "puts 1 + 1"}}' }
-  let(:context)  { double(:context) }
+  describe "refuses methods inherited from Object" do
+    {
+      'instance_eval'      => '{{instance_eval "$fs_rce_canary = :pwned"}}',
+      'instance_exec'      => '{{instance_exec "$fs_rce_canary = :pwned"}}',
+      'send'               => '{{send "instance_eval" "$fs_rce_canary = :pwned"}}',
+      '__send__'           => '{{__send__ "instance_eval" "$fs_rce_canary = :pwned"}}',
+      'public_send'        => '{{public_send "instance_eval" "$fs_rce_canary = :pwned"}}',
+      'method'             => '{{method "instance_eval"}}',
+      'object path form'   => '{{this.instance_eval "$fs_rce_canary = :pwned"}}',
+      'subexpression form' => '{{log (instance_eval "$fs_rce_canary = :pwned")}}',
+      # Decorator#method_missing is public and forwards to the context, and
+      # method_missing is private on BasicObject so it never appeared in
+      # Object.instance_methods.
+      'method_missing'     => '{{method_missing "instance_eval" "$fs_rce_canary = :pwned"}}',
+    }.each do |description, template|
+      it "refuses #{description}" do
+        $fs_rce_canary = nil
+
+        expect { evaluate(template) }.to raise_error(FlavourSaver::ForbiddenMethodException)
+
+        # Assert on the side effect too, not just the exception type: a payload
+        # that executes *and then* raises would satisfy raise_error alone.
+        expect($fs_rce_canary).to be_nil
+      end
+    end
+
+    it 'refuses block expression form' do
+      $fs_rce_canary = nil
+
+      expect {
+        evaluate('{{#instance_eval "$fs_rce_canary = :pwned"}}x{{/instance_eval}}')
+      }.to raise_error(FlavourSaver::ForbiddenMethodException)
+
+      expect($fs_rce_canary).to be_nil
+    end
+
+    it 'does not shell out via send' do
+      expect { evaluate(%q({{send "system" "echo pwned"}})) }
+        .to raise_error(FlavourSaver::ForbiddenMethodException)
+    end
+
+    it 'refuses regardless of the context object' do
+      [Object.new, { 'a' => 'b' }, Struct.new(:name).new('x'), 'a string', []].each do |ctx|
+        $fs_rce_canary = nil
+
+        expect { evaluate('{{instance_eval "$fs_rce_canary = :pwned"}}', ctx) }
+          .to raise_error(FlavourSaver::ForbiddenMethodException)
+
+        expect($fs_rce_canary).to be_nil
+      end
+    end
+
+    # Integer, Symbol and Float have no singleton class, so the visibility check
+    # raises TypeError rather than NameError. It must still resolve to a refusal
+    # (a primitive cannot carry a singleton method) rather than leaking an
+    # unrescued TypeError past the UnknownHelperException contract.
+    it 'refuses on primitive contexts without leaking TypeError' do
+      [5, :sym, 1.5].each do |ctx|
+        $fs_rce_canary = nil
+
+        expect { evaluate('{{instance_eval "$fs_rce_canary = :pwned"}}', ctx) }
+          .to raise_error(FlavourSaver::ForbiddenMethodException)
+
+        expect($fs_rce_canary).to be_nil
+      end
+    end
+
+    # The private forbidden_method? predicate must be correct on its own, not
+    # only behind the decorator wrapping in evaluate_call, since a primitive
+    # reaching it undecorated is the exact case that raised TypeError.
+    it 'the predicate refuses inherited methods on an undecorated primitive' do
+      runtime = FlavourSaver::Runtime.new(FlavourSaver.parse(FlavourSaver.lex('')), context)
+      expect(runtime.send(:forbidden_method?, 5, 'instance_eval')).to be true
+      # ...but leaves a primitive's own domain method dispatchable.
+      expect(runtime.send(:forbidden_method?, 5, 'bit_length')).to be false
+    end
+
+    it 'is catchable as UnknownHelperException, for existing rescue clauses' do
+      expect { evaluate('{{instance_eval "1"}}') }
+        .to raise_error(FlavourSaver::UnknownHelperException)
+    end
+
+    # Helpers.decorate_with only mixes in the helpers named in the runtime's
+    # helper list when that list is non-empty. A guard that consulted the global
+    # registry would exempt a name that was never mixed in, and dispatch would
+    # reach Object's implementation of it.
+    it 'refuses a registered helper name that was scoped out of this runtime' do
+      $fs_rce_canary = nil
+      FlavourSaver::Helpers.register_helper(:send) { 'helper!' }
+
+      ast = FlavourSaver.parse(FlavourSaver.lex('{{send "instance_eval" "$fs_rce_canary = :pwned"}}'))
+
+      expect { FlavourSaver::Runtime.new(ast, context, {}, [:this]).to_s }
+        .to raise_error(FlavourSaver::ForbiddenMethodException)
+
+      expect($fs_rce_canary).to be_nil
+    ensure
+      FlavourSaver::Helpers.deregister_helper(:send)
+    end
+
+    # Private Kernel methods are not refused by name -- doing so would break the
+    # ~60 context methods that share a name with one (format, open, select...).
+    # They are unreachable instead: public_send cannot call them, so they fall
+    # through to Decorator#method_missing, which also uses public_send. These
+    # assert non-execution rather than an exception type, because which error
+    # surfaces depends on the context object.
+    describe "private Kernel methods are unreachable" do
+      def expect_no_execution(template, ctx)
+        canary = File.join(Dir.tmpdir, "fs_rce_#{Process.pid}_#{rand(1 << 32)}")
+        begin
+          evaluate(format(template, canary), ctx)
+        rescue StandardError
+          # An exception is an acceptable outcome; execution is not.
+        end
+        expect(File.exist?(canary)).to be false
+      ensure
+        FileUtils.rm_f(canary)
+      end
 
-  it 'renders correctly' do
-    expect(Kernel).not_to receive(:eval)
-    expect { subject }.to raise_error(RuntimeError)
+      %w[system eval exec fork spawn require load syscall].each do |name|
+        it "does not execute #{name}" do
+          expect_no_execution(%({{#{name} "touch %s"}}), context)
+        end
+      end
+
+      # The OSVDB-110796 payload: a proxy or delegator answering true to
+      # everything used to make every private Kernel method reachable.
+      it 'does not execute against a context with a permissive respond_to?' do
+        permissive = Class.new { def respond_to?(name, priv = false); true; end }.new
+        expect_no_execution('{{system "touch %s"}}', permissive)
+      end
+
+      it 'does not execute via the send trampoline' do
+        expect_no_execution('{{send "system" "touch %s"}}', context)
+      end
+    end
+
+    # Object#try forwards to public_send, so a guard keyed on the method's owner
+    # being Object/Kernel/BasicObject would miss it: ActiveSupport mixes try into
+    # Object via its own module.
+    it 'refuses methods mixed into Object by a framework' do
+      $fs_rce_canary = nil
+
+      expect { evaluate('{{try "instance_eval" "$fs_rce_canary = :pwned"}}') }
+        .to raise_error(FlavourSaver::ForbiddenMethodException)
+
+      expect($fs_rce_canary).to be_nil
+    end
   end
-end
 
+  # Named coverage of the dangerous surface. These are behavioural rather than
+  # assertions about an internal list, so they keep their meaning regardless of
+  # how the guard is implemented.
+  describe "refuses each dangerous name individually" do
+    # No predicate names here: the lexer's IDENT rule is /([A-Za-z_]\w*)/, so a
+    # trailing ? cannot form part of a template identifier.
+    %w[instance_eval instance_exec send __send__ public_send method
+       define_singleton_method singleton_class class extend freeze
+       method_missing tap then itself].each do |name|
+      it "refuses #{name}" do
+        expect { evaluate("{{#{name}}}") }
+          .to raise_error(FlavourSaver::ForbiddenMethodException)
+      end
+    end
+  end
+
+  # Templates loaded from disk go through Tilt and FlavourSaver::Template rather
+  # than FlavourSaver.evaluate, so the refusal is asserted on that path too. This
+  # is what the original specs were reaching for: they passed the template *source*
+  # to Tilt.new, which expects a filename, so no engine matched and the whole
+  # suite short-circuited. Point it at a real .hbs fixture, as the other
+  # fixture specs do.
+  describe "refuses payloads in templates loaded from disk" do
+    let(:fixture) { File.expand_path('../../fixtures/rce.hbs', __FILE__) }
+
+    it 'refuses when rendered through Tilt' do
+      $fs_rce_canary = nil
+
+      expect { Tilt.new(fixture).render(context) }
+        .to raise_error(FlavourSaver::ForbiddenMethodException)
 
+      expect($fs_rce_canary).to be_nil
+    end
+
+    it 'has a fixture that really does contain a payload' do
+      expect(File.read(fixture)).to include 'instance_eval'
+    end
+  end
+
+  # The fix must not be so broad that it breaks ordinary templates.
+  describe "still allows legitimate dispatch" do
+    it 'calls a method the context actually defines' do
+      klass = Class.new { def greeting; 'hello'; end }
+      expect(evaluate('{{greeting}}', klass.new)).to eq 'hello'
+    end
+
+    it 'reads a data field named after an Object method via segment literals' do
+      expect(evaluate('{{[class]}}', { 'class' => 'btn-primary' })).to eq 'btn-primary'
+      expect(evaluate('{{[hash]}}',  { 'hash'  => 'abc123' })).to eq 'abc123'
+    end
+
+    it 'allows a deliberately registered helper to shadow an Object method' do
+      FlavourSaver::Helpers.register_helper(:hash) { 'abc123' }
+      expect(evaluate('{{hash}}')).to eq 'abc123'
+    ensure
+      FlavourSaver::Helpers.deregister_helper(:hash)
+    end
+
+    it 'allows a local to shadow an Object method' do
+      runtime = FlavourSaver::Runtime.new(
+        FlavourSaver.parse(FlavourSaver.lex('{{hash}}')),
+        context,
+        { 'hash' => proc { 'abc123' } }
+      )
+      expect(runtime.to_s).to eq 'abc123'
+    end
+
+    it 'still renders nothing for an unknown, non-forbidden method' do
+      expect(evaluate('{{no_such_method}}')).to eq ''
+    end
+
+    # Roughly sixty lexable names collide with a private Kernel method. They are
+    # plausible domain names and dispatched fine before 4.0.1, so refusing them
+    # would be a breaking change smuggled into a security patch.
+    %w[format open select print test load p raise loop gets rand warn catch].each do |name|
+      it "dispatches a context method named #{name}" do
+        klass = Class.new { define_method(name) { "value-#{name}" } }
+        expect(evaluate("{{#{name}}}", klass.new)).to eq "value-#{name}"
+      end
+    end
+  end
+end

data/spec/fixtures/rce.hbs

@@ -0,0 +1 @@
+{{instance_eval "$fs_rce_canary = :pwned"}}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: flavour_saver
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.0.1
 platform: ruby
 authors:
 - Clayton Passmore
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-04-09 00:00:00.000000000 Z
+date: 2026-08-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -133,6 +133,7 @@ files:
 - spec/fixtures/multi_level_with.hbs
 - spec/fixtures/one_character_identifier.hbs
 - spec/fixtures/raw.hbs
+- spec/fixtures/rce.hbs
 - spec/fixtures/sections.hbs
 - spec/fixtures/simple_expression.hbs
 - spec/fixtures/unless.hbs
@@ -193,6 +194,7 @@ test_files:
 - spec/fixtures/multi_level_with.hbs
 - spec/fixtures/one_character_identifier.hbs
 - spec/fixtures/raw.hbs
+- spec/fixtures/rce.hbs
 - spec/fixtures/sections.hbs
 - spec/fixtures/simple_expression.hbs
 - spec/fixtures/unless.hbs