jruby_sandbox 0.2.1-java → 0.2.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d9cee93864fe9088e39d5da9838a9929cd93eda3
-  data.tar.gz: c1f9ab8ae12cf194cc39838a6201ae35b5f769a1
+  metadata.gz: 3cdc0b53cef5a2d1d509646a3b963d348b50e06d
+  data.tar.gz: 41e5404e7e6c76dfc1ff75be32c640e7e2aeb39f
 SHA512:
-  metadata.gz: 915fab034e4d057e037af65442755c67f6812c4b8d12a6d276e82e06fc2ac5658a720976ccb06a079409ed66b0c3b0a72a5b14cfb91bd60540a30704cf097535
-  data.tar.gz: cc393077aa2d6f4ddc696ec058e727f8982224a517097385f341e726ac3de94b709bb58e4d4641aae5918d94fa0033e61f5955f6ca73e52785072891f0828713
+  metadata.gz: c23b753187b1c877a27e4d443e38a79653d092fef60ad03d5fca2b3aa033e1609ec51bd66cfb784c1b96aa8363d2d2087b8abb7255666aca756052aa732719a8
+  data.tar.gz: 5f2c9be34c59aef1d159521c88ba4d4687a237a99d85f1b7522a4272f8bbfd8aa7e9849ca902b3ee831af0b428800f8de0f7cf79465c21dca6b53ac45af48e71

data/Gemfile.lock

@@ -8,7 +8,7 @@ GIT
 PATH
   remote: .
   specs:
-    jruby_sandbox (0.2.0-java)
+    jruby_sandbox (0.2.2-java)
       fakefs
 
 GEM

data/lib/sandbox/version.rb

@@ -1,3 +1,3 @@
 module Sandbox
-  VERSION = '0.2.1'
+  VERSION = '0.2.2'
 end

data/lib/sandbox.rb

@@ -38,6 +38,9 @@ module Sandbox
         def `(*args)
           raise NoMethodError, "` is unavailable"
         end
+        def system(*args)
+          raise NoMethodError, "system is unavailable"
+        end
       end
     end
     

data/spec/exploits_spec.rb

@@ -18,6 +18,12 @@ describe "Sandbox exploits" do
     }.to raise_error(Sandbox::SandboxException)
   end
 
+  it "should not allow running system commands using system" do
+    expect {
+      subject.eval 'system("ls")'
+    }.to raise_error(Sandbox::SandboxException, /NoMethodError/)
+  end
+
   it "should not allow running system commands through File.class_eval" do
     expect {
       subject.eval 'File.class_eval { `echo Hello` }'
@@ -36,6 +42,24 @@ describe "Sandbox exploits" do
     }.to raise_error(Sandbox::SandboxException, /NoMethodError/)
   end
 
+  it "should not allow running system commands through File.eval" do
+    expect {
+      subject.eval 'File.eval "`echo Hello`"'
+    }.to raise_error(Sandbox::SandboxException, /NoMethodError/)
+
+    expect {
+      subject.eval 'FileUtils.eval "`echo Hello`"'
+    }.to raise_error(Sandbox::SandboxException, /NoMethodError/)
+
+    expect {
+      subject.eval 'Dir.eval "`echo Hello`"'
+    }.to raise_error(Sandbox::SandboxException, /NoMethodError/)
+
+    expect {
+      subject.eval 'FileTest.eval "`echo Hello`"'
+    }.to raise_error(Sandbox::SandboxException, /NoMethodError/)
+  end
+
   it "should not allow running system commands through File.instance_eval" do
     expect {
       subject.eval 'File.instance_eval { `echo Hello` }'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jruby_sandbox
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: java
 authors:
 - Dray Lacy