marshalsea 0.1.0

data/lib/marshalsea/marshal/boundary_detector.rb

@@ -0,0 +1,186 @@
+# ©AngelaMos | 2026
+# boundary_detector.rb
+# frozen_string_literal: true
+
+module Marshalsea
+  module Marshal
+    class ReporterRequiredError < StandardError; end
+
+    class BoundaryDetector
+      POLICY_STRICT_ALLOWLIST = :strict_allowlist
+      POLICY_DENY_SINKS_ONLY = :deny_sinks_only
+      POLICY_OBSERVE_AND_LOG = :observe_and_log
+
+      POLICIES = [POLICY_STRICT_ALLOWLIST, POLICY_DENY_SINKS_ONLY, POLICY_OBSERVE_AND_LOG].freeze
+
+      REASON_INPUT_TYPE = "input is not a String"
+      REASON_MALFORMED = "stream is not canonical Marshal: %s"
+      REASON_SINK = "stream reaches %s#%s during load, before any allowlist can run"
+      REASON_UNAPPROVED = "stream references unapproved class %s"
+      REASON_ROLE_ANOMALY = "stream is not canonical Marshal: %s, so Marshal.load refuses it " \
+                            "and there is nothing here to permit"
+      REASON_KEY_HASH = "stream puts %s in a hash key, so its #hash runs during load, before " \
+                        "any allowlist can act"
+      REASON_KEY_EQL = "stream puts %s in a hash key, so its #eql? runs during load as soon as " \
+                       "two keys collide, before any allowlist can act"
+      REASON_RANGE_ENDPOINT = "stream puts %s in a Range endpoint, so its #<=> runs during " \
+                              "load, before any allowlist can act"
+      REASON_NONCANONICAL_VERSION = "stream declares Marshal %d.%d; every Ruby that can produce " \
+                                    "this format emits %d.%d"
+
+      REASON_MAX_NAME_BYTES = 96
+      REASON_MAX_NAMES = 8
+      REASON_TRUNCATED_MARKER = "[truncated"
+      REASON_TRUNCATED = "#{REASON_TRUNCATED_MARKER}, +%d bytes]".freeze
+      REASON_ELIDED_NAMES = ", and %d more"
+      REASON_NAME_SEPARATOR = ", "
+
+      LIMITATION_NOTICE = <<~NOTICE
+        SECURITY LIMITATION
+
+        Marshalsea::Marshal::BoundaryDetector examines a bounded snapshot of Marshal bytes and
+        applies a caller-selected policy before deserialization. An ACCEPT decision means
+        only that this snapshot matched that policy.
+
+        Acceptance does not make the payload safe, trusted, authenticated, or free of
+        gadget behavior. This detector does not sandbox Ruby, audit the current
+        implementations of allowlisted classes, freeze the runtime class graph, or prevent
+        callbacks and implicit method dispatch that its parser or policy fails to model.
+        Class allowlisting compares serialized names. It does not prove that the
+        corresponding Ruby code is harmless.
+
+        A payload carrying no sink tag can still reach dangerous code. The published
+        CVE-2026-41316 chain produces zero sink tags because ERB defines no marshal_load.
+        It is caught by class allowlisting alone, and an application that allowlists ERB
+        will accept it.
+      NOTICE
+
+      class Decision
+        STATE_PROCEED = :proceed
+        STATE_BLOCKED = :blocked
+        STATE_OBSERVED = :observed
+
+        STATES = [STATE_PROCEED, STATE_BLOCKED, STATE_OBSERVED].freeze
+        STATE_PREDICATES = %i[proceed? blocked? observed?].freeze
+
+        UNKNOWN_STATE = "unknown decision state %p, expected one of %s"
+
+        attr_reader :state, :reason, :snapshot, :result
+
+        def initialize(state:, reason: nil, snapshot: nil, result: nil)
+          raise ArgumentError, format(UNKNOWN_STATE, state, STATES.join(", ")) unless STATES.include?(state)
+
+          @state = state
+          @reason = reason
+          @snapshot = snapshot
+          @result = result
+        end
+
+        def proceed?
+          state == STATE_PROCEED
+        end
+
+        def blocked?
+          state == STATE_BLOCKED
+        end
+
+        def observed?
+          state == STATE_OBSERVED
+        end
+      end
+
+      def initialize(policy: POLICY_STRICT_ALLOWLIST, allowed_class_names: [], limits: Limits.new, reporter: nil)
+        raise ArgumentError, "unknown policy #{policy}" unless POLICIES.include?(policy)
+        raise ReporterRequiredError, "#{POLICY_OBSERVE_AND_LOG} requires a reporter" if
+          policy == POLICY_OBSERVE_AND_LOG && reporter.nil?
+
+        @policy = policy
+        @allowed_class_names = allowed_class_names.map(&:to_s).freeze
+        @limits = limits
+        @reporter = reporter
+      end
+
+      def inspect_stream(input)
+        return reject(REASON_INPUT_TYPE) unless input.is_a?(String)
+
+        snapshot = input.dup.force_encoding(Encoding::BINARY).freeze
+        result = Parser.new(snapshot, limits: limits).parse
+        evaluate(result, snapshot)
+      rescue StreamError => e
+        reject(format(REASON_MALFORMED, e.class.name.split("::").last))
+      end
+
+      private
+
+      attr_reader :policy, :allowed_class_names, :limits, :reporter
+
+      def evaluate(result, snapshot)
+        violation = violation_for(result)
+        return accept(snapshot, result) unless violation
+
+        return observe(violation, snapshot, result) if policy == POLICY_OBSERVE_AND_LOG
+
+        reject(violation)
+      end
+
+      def quoted(name)
+        raw = name.to_s.dup.force_encoding(Encoding::BINARY)
+        return raw.inspect if raw.bytesize <= REASON_MAX_NAME_BYTES
+
+        "#{raw.byteslice(0, REASON_MAX_NAME_BYTES).inspect}" \
+          "#{format(REASON_TRUNCATED, raw.bytesize - REASON_MAX_NAME_BYTES)}"
+      end
+
+      def quoted_list(names)
+        shown = names.first(REASON_MAX_NAMES).map { |name| quoted(name) }.join(REASON_NAME_SEPARATOR)
+        elided = names.length - REASON_MAX_NAMES
+        return shown unless elided.positive?
+
+        "#{shown}#{format(REASON_ELIDED_NAMES, elided)}"
+      end
+
+      def violation_for(result)
+        anomaly = result.role_anomalies.first
+        return format(REASON_ROLE_ANOMALY, anomaly) if anomaly
+
+        sink = result.sinks.first
+        return format(REASON_SINK, quoted(sink.class_name), sink.sink_method) if sink
+
+        hashed = result.hash_dispatching_keys.first
+        return format(REASON_KEY_HASH, quoted(hashed.effective_class_name)) if hashed
+
+        compared = result.eql_dispatching_keys.first
+        return format(REASON_KEY_EQL, quoted(compared.effective_class_name)) if compared
+
+        endpoint = result.range_endpoint_dispatchers.first
+        return format(REASON_RANGE_ENDPOINT, quoted(endpoint.effective_class_name)) if endpoint
+
+        return nil if policy == POLICY_DENY_SINKS_ONLY
+
+        unless result.canonical_version?
+          return format(REASON_NONCANONICAL_VERSION, result.major, result.minor,
+                        Constants::MAJOR_VERSION, Constants::MINOR_VERSION)
+        end
+
+        unapproved = result.class_names.reject { |name| allowed_class_names.include?(name) }
+        return format(REASON_UNAPPROVED, quoted_list(unapproved)) unless unapproved.empty?
+
+        nil
+      end
+
+      def observe(violation, snapshot, result)
+        reporter.call(violation)
+        Decision.new(state: Decision::STATE_OBSERVED, reason: violation,
+                     snapshot: snapshot, result: result)
+      end
+
+      def accept(snapshot, result)
+        Decision.new(state: Decision::STATE_PROCEED, snapshot: snapshot, result: result)
+      end
+
+      def reject(reason)
+        Decision.new(state: Decision::STATE_BLOCKED, reason: reason)
+      end
+    end
+  end
+end

data/lib/marshalsea/marshal/constants.rb

@@ -0,0 +1,91 @@
+# ©AngelaMos | 2026
+# constants.rb
+# frozen_string_literal: true
+
+module Marshalsea
+  module Marshal
+    module Constants
+      MAJOR_VERSION = 4
+      MINOR_VERSION = 8
+      HEADER_LENGTH = 2
+
+      TAG_NIL = "0"
+      TAG_TRUE = "T"
+      TAG_FALSE = "F"
+      TAG_FIXNUM = "i"
+      TAG_BIGNUM = "l"
+      TAG_FLOAT = "f"
+      TAG_STRING = '"'
+      TAG_SYMBOL = ":"
+      TAG_SYMLINK = ";"
+      TAG_OBJECT_LINK = "@"
+      TAG_ARRAY = "["
+      TAG_HASH = "{"
+      TAG_HASH_DEFAULT = "}"
+      TAG_REGEXP = "/"
+      TAG_OBJECT = "o"
+      TAG_USERDEF = "u"
+      TAG_USERMARSHAL = "U"
+      TAG_USERCLASS = "C"
+      TAG_EXTENDED = "e"
+      TAG_CLASS = "c"
+      TAG_MODULE = "m"
+      TAG_MODULE_OLD = "M"
+      TAG_STRUCT = "S"
+      TAG_DATA = "d"
+      TAG_IVAR = "I"
+
+      NUL_BYTE = "\x00"
+
+      FLOAT_NAN = "nan"
+      FLOAT_INFINITY = "inf"
+      FLOAT_NEGATIVE_INFINITY = "-inf"
+
+      FLOAT_LEADING_SPACE = "[ \t\n\v\f\r]*"
+      FLOAT_HEX_PREFIX = /\A#{FLOAT_LEADING_SPACE}[+-]?0[xX](?:\h+(?:\.\h*)?|\.\h+)(?:[pP][+-]?\d+)?/
+      FLOAT_DECIMAL_PREFIX = /\A#{FLOAT_LEADING_SPACE}[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?/
+
+      BIGNUM_SIGN_POSITIVE = "+"
+      BIGNUM_SIGN_NEGATIVE = "-"
+      BIGNUM_SIGNS = [BIGNUM_SIGN_POSITIVE, BIGNUM_SIGN_NEGATIVE].freeze
+      BIGNUM_WORD_BYTES = 2
+
+      FIXNUM_INLINE_OFFSET = 5
+      FIXNUM_MAX_INLINE = 4
+      FIXNUM_MIN_INLINE = -4
+      FIXNUM_MAX_WIDTH = 4
+
+      BYTE_SIGN_THRESHOLD = 128
+      BYTE_MODULUS = 256
+      BITS_PER_BYTE = 8
+
+      DEFAULT_MAX_DEPTH = 256
+
+      ROLE_LENGTH = "byte length"
+      ROLE_ARRAY = "array element"
+      ROLE_HASH = "hash entry"
+      ROLE_IVAR = "instance variable"
+      ROLE_STRUCT = "struct member"
+      ROLE_BIGNUM = "bignum word"
+
+      ROLE_ANOMALY = "%s name slot holds %s, not a symbol"
+
+      CLASS_NAME_TYPES = %i[symbol symlink].freeze
+
+      RANGE_CLASS_NAME = "Range"
+      RANGE_ENDPOINT_IVARS = %i[begin end].freeze
+
+      REGISTERED_WRAPPER_TYPES = %i[data].freeze
+
+      SINK_TAGS = [TAG_USERDEF, TAG_USERMARSHAL, TAG_DATA].freeze
+
+      SINK_METHODS = {
+        TAG_USERDEF => "_load",
+        TAG_USERMARSHAL => "marshal_load",
+        TAG_DATA => "_load_data"
+      }.freeze
+
+      GATED_SINK_TAGS = [TAG_USERDEF, TAG_USERMARSHAL, TAG_DATA].freeze
+    end
+  end
+end

data/lib/marshalsea/marshal/errors.rb

@@ -0,0 +1,29 @@
+# ©AngelaMos | 2026
+# errors.rb
+# frozen_string_literal: true
+
+module Marshalsea
+  module Marshal
+    class StreamError < StandardError; end
+
+    class TruncatedStreamError < StreamError; end
+
+    class UnsupportedVersionError < StreamError; end
+
+    class UnknownTagError < StreamError; end
+
+    class TrailingBytesError < StreamError; end
+
+    class InvalidLinkError < StreamError; end
+
+    class DepthLimitError < StreamError; end
+
+    class MalformedCountError < StreamError; end
+
+    class MalformedValueError < StreamError; end
+
+    class LimitExceededError < StreamError; end
+
+    class InputTypeError < StreamError; end
+  end
+end

data/lib/marshalsea/marshal/float_body.rb

@@ -0,0 +1,40 @@
+# ©AngelaMos | 2026
+# float_body.rb
+# frozen_string_literal: true
+
+module Marshalsea
+  module Marshal
+    module FloatBody
+      module_function
+
+      def decode(body)
+        text = body.b
+        named = named_value(text)
+        return [named, nil] if named
+
+        token = prefix(text)
+        tail = text.byteslice(token.bytesize..)
+        [value_of(token), tail.empty? ? nil : tail]
+      end
+
+      def named_value(text)
+        case text.byteslice(0, text.index(Constants::NUL_BYTE) || text.bytesize)
+        when Constants::FLOAT_NAN then Float::NAN
+        when Constants::FLOAT_INFINITY then Float::INFINITY
+        when Constants::FLOAT_NEGATIVE_INFINITY then -Float::INFINITY
+        end
+      end
+
+      def prefix(text)
+        match = Constants::FLOAT_HEX_PREFIX.match(text) ||
+                Constants::FLOAT_DECIMAL_PREFIX.match(text)
+        match ? match[0] : ""
+      end
+
+      def value_of(token)
+        stripped = token.strip
+        stripped.empty? ? 0.0 : Float(stripped)
+      end
+    end
+  end
+end

data/lib/marshalsea/marshal/limits.rb

@@ -0,0 +1,172 @@
+# ©AngelaMos | 2026
+# limits.rb
+# frozen_string_literal: true
+
+module Marshalsea
+  module Marshal
+    class Limits
+      DEFAULT_MAX_BYTES = 1_048_576
+      DEFAULT_MAX_DEPTH = 64
+      DEFAULT_MAX_NODES = 10_000
+      DEFAULT_MAX_REGISTERED_OBJECTS = 4_096
+      DEFAULT_MAX_SYMBOL_DEFINITIONS = 256
+      DEFAULT_MAX_COLLECTION_ENTRIES = 1_024
+      DEFAULT_MAX_SCALAR_BYTES = 262_144
+      DEFAULT_MAX_TOTAL_SCALAR_BYTES = 524_288
+      DEFAULT_MAX_OBJECT_LINKS = 2_048
+      DEFAULT_MAX_SYMBOL_REFERENCES = 2_048
+      DEFAULT_MAX_SYMBOL_NAME_BYTES = 1_024
+      DEFAULT_MAX_CLASS_NAME_BYTES = 1_024
+      DEFAULT_MAX_INSTANCE_VARIABLES = 256
+      DEFAULT_MAX_STRUCT_MEMBERS = 256
+
+      ROLE_BYTES = "stream bytes"
+      ROLE_NODES = "nodes"
+      ROLE_REGISTERED = "registered objects"
+      ROLE_SYMBOLS = "symbol definitions"
+      ROLE_ENTRIES = "collection entries"
+      ROLE_SCALAR = "scalar bytes"
+      ROLE_TOTAL_SCALAR = "total scalar bytes"
+      ROLE_LINKS = "object links"
+      ROLE_SYMBOL_REFERENCES = "symbol references"
+      ROLE_SYMBOL_NAME = "symbol name bytes"
+      ROLE_CLASS_NAME = "class name bytes"
+      ROLE_INSTANCE_VARIABLES = "instance variables"
+      ROLE_STRUCT_MEMBERS = "struct members"
+
+      UNBOUNDED = Float::INFINITY
+
+      attr_reader :max_bytes, :max_depth, :max_nodes, :max_registered_objects,
+                  :max_symbol_definitions, :max_collection_entries,
+                  :max_scalar_bytes, :max_total_scalar_bytes, :max_object_links,
+                  :max_symbol_references, :max_symbol_name_bytes, :max_class_name_bytes,
+                  :max_instance_variables, :max_struct_members
+
+      def initialize(
+        max_bytes: DEFAULT_MAX_BYTES,
+        max_depth: DEFAULT_MAX_DEPTH,
+        max_nodes: DEFAULT_MAX_NODES,
+        max_registered_objects: DEFAULT_MAX_REGISTERED_OBJECTS,
+        max_symbol_definitions: DEFAULT_MAX_SYMBOL_DEFINITIONS,
+        max_collection_entries: DEFAULT_MAX_COLLECTION_ENTRIES,
+        max_scalar_bytes: DEFAULT_MAX_SCALAR_BYTES,
+        max_total_scalar_bytes: DEFAULT_MAX_TOTAL_SCALAR_BYTES,
+        max_object_links: DEFAULT_MAX_OBJECT_LINKS,
+        max_symbol_references: DEFAULT_MAX_SYMBOL_REFERENCES,
+        max_symbol_name_bytes: DEFAULT_MAX_SYMBOL_NAME_BYTES,
+        max_class_name_bytes: DEFAULT_MAX_CLASS_NAME_BYTES,
+        max_instance_variables: DEFAULT_MAX_INSTANCE_VARIABLES,
+        max_struct_members: DEFAULT_MAX_STRUCT_MEMBERS
+      )
+        @max_bytes = max_bytes
+        @max_depth = max_depth
+        @max_nodes = max_nodes
+        @max_registered_objects = max_registered_objects
+        @max_symbol_definitions = max_symbol_definitions
+        @max_collection_entries = max_collection_entries
+        @max_scalar_bytes = max_scalar_bytes
+        @max_total_scalar_bytes = max_total_scalar_bytes
+        @max_object_links = max_object_links
+        @max_symbol_references = max_symbol_references
+        @max_symbol_name_bytes = max_symbol_name_bytes
+        @max_class_name_bytes = max_class_name_bytes
+        @max_instance_variables = max_instance_variables
+        @max_struct_members = max_struct_members
+      end
+
+      STACK_SAFE_MAX_DEPTH = Constants::DEFAULT_MAX_DEPTH
+
+      def self.permissive
+        new(
+          max_bytes: UNBOUNDED,
+          max_depth: STACK_SAFE_MAX_DEPTH,
+          max_nodes: UNBOUNDED,
+          max_registered_objects: UNBOUNDED,
+          max_symbol_definitions: UNBOUNDED,
+          max_collection_entries: UNBOUNDED,
+          max_scalar_bytes: UNBOUNDED,
+          max_total_scalar_bytes: UNBOUNDED,
+          max_object_links: UNBOUNDED,
+          max_symbol_references: UNBOUNDED,
+          max_symbol_name_bytes: UNBOUNDED,
+          max_class_name_bytes: UNBOUNDED,
+          max_instance_variables: UNBOUNDED,
+          max_struct_members: UNBOUNDED
+        )
+      end
+    end
+
+    class Budget
+      def initialize(limits)
+        @limits = limits
+        @nodes = 0
+        @registered = 0
+        @symbols = 0
+        @links = 0
+        @symbol_references = 0
+        @scalar_total = 0
+      end
+
+      def node!
+        @nodes += 1
+        check(@nodes, limits.max_nodes, Limits::ROLE_NODES)
+      end
+
+      def registered!
+        @registered += 1
+        check(@registered, limits.max_registered_objects, Limits::ROLE_REGISTERED)
+      end
+
+      def symbol!
+        @symbols += 1
+        check(@symbols, limits.max_symbol_definitions, Limits::ROLE_SYMBOLS)
+      end
+
+      def link!
+        @links += 1
+        check(@links, limits.max_object_links, Limits::ROLE_LINKS)
+      end
+
+      def symbol_reference!
+        @symbol_references += 1
+        check(@symbol_references, limits.max_symbol_references, Limits::ROLE_SYMBOL_REFERENCES)
+      end
+
+      def symbol_name!(size)
+        check(size, limits.max_symbol_name_bytes, Limits::ROLE_SYMBOL_NAME)
+      end
+
+      def class_name!(size)
+        check(size, limits.max_class_name_bytes, Limits::ROLE_CLASS_NAME)
+      end
+
+      def instance_variables!(count)
+        check(count, limits.max_instance_variables, Limits::ROLE_INSTANCE_VARIABLES)
+      end
+
+      def struct_members!(count)
+        check(count, limits.max_struct_members, Limits::ROLE_STRUCT_MEMBERS)
+      end
+
+      def entries!(count)
+        check(count, limits.max_collection_entries, Limits::ROLE_ENTRIES)
+      end
+
+      def scalar!(size)
+        check(size, limits.max_scalar_bytes, Limits::ROLE_SCALAR)
+        @scalar_total += size
+        check(@scalar_total, limits.max_total_scalar_bytes, Limits::ROLE_TOTAL_SCALAR)
+      end
+
+      private
+
+      attr_reader :limits
+
+      def check(value, ceiling, role)
+        return if value <= ceiling
+
+        raise LimitExceededError, "#{role} #{value} exceeds #{ceiling}"
+      end
+    end
+  end
+end

data/lib/marshalsea/marshal/load_guard.rb

@@ -0,0 +1,120 @@
+# ©AngelaMos | 2026
+# load_guard.rb
+# frozen_string_literal: true
+
+module Marshalsea
+  module Marshal
+    class GuardedLoadError < StandardError; end
+
+    class LoadGuard
+      GATED_HOOKS = %i[marshal_load _load _load_data].freeze
+      DISPATCH_HOOKS = %i[method_missing respond_to_missing?].freeze
+      KEY_HOOKS = %i[hash eql?].freeze
+
+      DEFAULT_HOOKS = (GATED_HOOKS + DISPATCH_HOOKS).freeze
+      STRICT_HOOKS = (DEFAULT_HOOKS + KEY_HOOKS).freeze
+
+      EVENTS = %i[call c_call].freeze
+
+      REASON = "deserialization hook %s#%s is not permitted"
+      ANONYMOUS_OWNER = "(class with no name)"
+
+      LIMITATION_NOTICE = <<~NOTICE
+        SECURITY LIMITATION
+
+        Marshalsea::Marshal::LoadGuard vetoes a deserialization hook before its body runs,
+        which is the thing a Marshal.load allowlist proc cannot do. It is defense in depth
+        and a tripwire. It is not a boundary, and it never makes Marshal.load on untrusted
+        input safe.
+
+        It covers the load window only. A class carrying no hook at all is instantiated
+        freely and fires whenever the application later touches it, which is outside any
+        window this guard can see.
+
+        With the default hook set it does not watch #hash or #eql?. Rebuilding a Hash
+        rehashes its keys, so a key object's #hash runs inside Marshal.load with no
+        deserialization hook involved. Pass strict: true to watch those two as well, and
+        accept that they are among the hottest methods in Ruby: the cost and the
+        false-positive profile both change completely. Marshalsea::Marshal::BoundaryDetector
+        catches that same shape before any bytes are loaded, which is the cheaper place
+        to catch it.
+
+        The guard is thread-scoped. A load on another thread is not covered.
+
+        Its cost is not a multiplier. Enabling a TracePoint costs roughly 46 microseconds
+        per load on a stock ruby:4.0-slim, near enough constant, so the ratio is decided by
+        how much work the load itself does. Measured 2026-07-30: 40x on a 45-byte session
+        cookie, 21x on a 142-byte session, 1.1x on a 46 KB document, 1.0x on a 488 KB one.
+        Guarding a large payload is close to free. Guarding a session cookie on every
+        request is not, and a cookie is exactly what this lab deserializes.
+      NOTICE
+
+      class Observation
+        attr_reader :class_name, :method_name
+
+        def initialize(class_name:, method_name:, permitted:)
+          @class_name = class_name
+          @method_name = method_name
+          @permitted = permitted
+        end
+
+        def permitted?
+          @permitted
+        end
+
+        def to_s
+          "#{class_name}##{method_name}"
+        end
+      end
+
+      attr_reader :observations
+
+      def initialize(permitted_class_names: [], strict: false)
+        @permitted_class_names = permitted_class_names.map(&:to_s).freeze
+        @hooks = strict ? STRICT_HOOKS : DEFAULT_HOOKS
+        @observations = [].freeze
+      end
+
+      def load(blob)
+        seen = []
+        tracer = TracePoint.new(*EVENTS) { |event| inspect_event(event, seen) }
+        result = nil
+        begin
+          tracer.enable { result = ::Marshal.load(blob) }
+        ensure
+          @observations = seen.freeze
+        end
+        result
+      end
+
+      def watches?(hook)
+        hooks.include?(hook)
+      end
+
+      private
+
+      attr_reader :permitted_class_names, :hooks
+
+      def inspect_event(event, seen)
+        return unless hooks.include?(event.method_id)
+
+        owner = owner_name(event.self)
+        label = owner || ANONYMOUS_OWNER
+        permitted = !owner.nil? && permitted_class_names.include?(owner)
+        seen << Observation.new(class_name: label, method_name: event.method_id,
+                                permitted: permitted)
+        return if permitted
+
+        raise GuardedLoadError, format(REASON, label, event.method_id)
+      end
+
+      def owner_name(receiver)
+        owner = receiver.is_a?(Module) ? receiver : receiver.class
+        name = owner.name
+        name if name.is_a?(String) && !name.empty?
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end