jruby_sandbox 0.2.0-java → 0.2.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 072482dce6da86c8ee7a942fb1e66fd00debe215
-  data.tar.gz: 01767fa5c25221cd5fc66dd15210b7e6c6106078
+  metadata.gz: d9cee93864fe9088e39d5da9838a9929cd93eda3
+  data.tar.gz: c1f9ab8ae12cf194cc39838a6201ae35b5f769a1
 SHA512:
-  metadata.gz: fee8ee1cde9b266b761c4300e17d05354da618afcb04ed56462042fdff8ed2b5af8edf1459a6d66b59d7f8378199e907cd283530c83e469ea80744f62651ac2f
-  data.tar.gz: 869380ff05222788d77bb6be8fe24a68998d28734b53150f6aef5963bcd8cf3cd9e1749d79ee1cac84c77720515ec08ff3329282fb897d299d38e7d99436be37
+  metadata.gz: 915fab034e4d057e037af65442755c67f6812c4b8d12a6d276e82e06fc2ac5658a720976ccb06a079409ed66b0c3b0a72a5b14cfb91bd60540a30704cf097535
+  data.tar.gz: cc393077aa2d6f4ddc696ec058e727f8982224a517097385f341e726ac3de94b709bb58e4d4641aae5918d94fa0033e61f5955f6ca73e52785072891f0828713

data/lib/sandbox/version.rb

@@ -1,3 +1,3 @@
 module Sandbox
-  VERSION = '0.2.0'
+  VERSION = '0.2.1'
 end

data/lib/sandbox.rb

@@ -33,6 +33,12 @@ module Sandbox
       keep_methods(:FalseClass, FALSECLASS_METHODS)
       keep_methods(:Enumerable, ENUMERABLE_METHODS)
       keep_methods(:String, STRING_METHODS)
+
+      Kernel.class_eval do
+        def `(*args)
+          raise NoMethodError, "` is unavailable"
+        end
+      end
     end
     
     def activate_fakefs

data/spec/exploits_spec.rb

@@ -12,6 +12,12 @@ describe "Sandbox exploits" do
     subject.activate!
   end
 
+  it 'should not allow access to the filesystem using backticks' do
+    expect {
+      subject.eval('`cat spec/support/foo.txt`')
+    }.to raise_error(Sandbox::SandboxException)
+  end
+
   it "should not allow running system commands through File.class_eval" do
     expect {
       subject.eval 'File.class_eval { `echo Hello` }'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jruby_sandbox
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: java
 authors:
 - Dray Lacy
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2013-11-08 00:00:00.000000000 Z
+date: 2013-11-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fakefs