safe_parser 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 4dec86a0cbf3ff35e64fa2fd8444a98221cfac57
+  data.tar.gz: 857a5b7591c5ea6c9c923158c721bb5b5b8eab67
+SHA512:
+  metadata.gz: a1f3cc4730f09e8c9581e957e317c9965597df0c18d01c82f192238f57acd60491fdffb306bc816e98248d6abcd9166265d2fba9fb5bd0aa6a6074f39acae9f7
+  data.tar.gz: d48802e12b0321116353e2a9a4bf06b1eb5cdcadbbafd7976ed6cca2d9bbf833c384c8c2a56e90eb239b582286dff8ed574a8fd369fc8487d0b26dc5c6da818c

data/History.txt

@@ -0,0 +1,5 @@
+=== 0.0.1 / 2017-03-29
+
+* Initial implementation
+
+The whitelist based implementation only loads the classes Psych::safe_load loads.

data/Manifest.txt

@@ -0,0 +1,6 @@
+History.txt
+Manifest.txt
+README.txt
+Rakefile
+lib/safe_parser.rb
+test/test_safe_parser.rb

data/README.txt

@@ -0,0 +1,74 @@
+= blah
+
+home  :: https://github.com/bibstha/ruby_hash_parser
+code  :: https://github.com/bibstha/ruby_hash_parser
+bugs  :: https://github.com/bibstha/ruby_hash_parser
+... etc ...
+
+== DESCRIPTION:
+
+Parses a hash string of the format `'{ :a => "something" }'` into an actual ruby hash object `{ a: "something" }`.
+This is useful when you by mistake serialize hashes and save it in database column or a text file and you want to
+convert them back to hashes without the security issues of executing `eval(hash_string)`.
+
+By default only following classes are allowed to be deserialized:
+
+* TrueClass
+* FalseClass
+* NilClass
+* Numeric
+* String
+* Array
+* Hash
+
+A HashParser::BadHash exception is thrown if unserializable values are present.
+
+== FEATURES/PROBLEMS:
+
+* Any potential security issues?
+
+== INSTALL:
+
+* Add to Gemfile: `gem 'hash_parser'`
+
+== DEVELOPERS:
+
+    require 'hash_parser'
+
+    # This successfully parses the hash
+    a = "{ :key_a => { :key_1a => 'value_1a', :key_2a => 'value_2a' },
+           :key_b => { :key_1b => 'value_1b' } }"
+    p HashParser.new.safe_load(a)
+
+    # This throws a HashParser::BadHash exception
+    a = "{ :key_a => system('ls') }"
+    p HashParser.new.safe_load(a)
+
+== TODO:
+
+* Allow objects of certain types to be deserialized
+
+== LICENSE:
+
+(The MIT License)
+
+Copyright (c) 2017 FIX
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/Rakefile

@@ -0,0 +1,13 @@
+# -*- ruby -*-
+
+require 'hoe'
+
+Hoe.spec 'safe_parser' do
+  developer 'Bibek Shrestha', 'bibekshrestha@gmail.com'
+
+  license "MIT"
+
+  dependency "ruby_parser", "~> 3.8.4"
+end
+
+# vim: syntax=ruby

data/lib/safe_parser.rb

@@ -0,0 +1,46 @@
+require "ruby_parser"
+
+# Whiltelist based hash string parser
+class SafeParser
+  VERSION = "1.0.0"
+
+  UnsafeError = Class.new(StandardError)
+  attr_reader :string
+
+  def initialize(string)
+    @string = string
+  end
+
+  def safe_load
+    parse(root_expression)
+  end
+
+  private
+
+  def parse(expression)
+    case expression.head
+    when :hash
+      Hash[*parse_into_array(expression.values)]
+    when :array
+      parse_into_array(expression.values)
+    when :true
+      true
+    when :false
+      false
+    when :nil
+      nil
+    when :lit, :str
+      expression.value
+    else
+      raise UnsafeError, "#{ string } is a bad hash"
+    end
+  end
+
+  def root_expression
+    @root_expression ||= RubyParser.new.parse(string)
+  end
+
+  def parse_into_array(expression)
+    expression.map { |child_expression| parse(child_expression) }
+  end
+end

data/test/test_safe_parser.rb

@@ -0,0 +1,97 @@
+require "minitest/autorun"
+require "minitest/spec"
+require "minitest/pride"
+require "safe_parser"
+
+describe SafeParser do
+  describe "#safe_load" do
+    it "fails if it is not a hash" do
+      strs =  ["Book.delete_all", "puts 'hello'", '"#{puts 123}"', "system('ls /')"]
+      strs.each do |bad_str|
+        assert_raises SafeParser::UnsafeError, "#{ bad_str } should not be safe" do
+          SafeParser.new(bad_str).safe_load
+        end
+      end
+    end
+
+    it "fails if there are more than one expression" do
+      strs = ["{ :a => 1 }; 'hello'", "{ :a => 1 }\n{ :b => 2 }"]
+      strs.each do |bad_str|
+        assert_raises SafeParser::UnsafeError, "#{ bad_str } should not be safe" do
+          SafeParser.new(bad_str).safe_load
+        end
+      end
+    end
+
+    it "Does not define or redefine any methods" do
+      str = '{ :a => refine(UnsafeError) { def safe?; "HAHAHA"; end } }'
+      assert_raises SafeParser::UnsafeError, "#{ str } should not be safe" do
+        SafeParser.new(str).safe_load
+      end
+
+      str = '{ :a => def SafeParser.safe?; "HAHAHA"; end }'
+      assert_raises SafeParser::UnsafeError, "#{ str } should not be safe" do
+        SafeParser.new(str).safe_load
+      end
+    end
+
+    it "fails if it has assignment" do
+      strs = ['{ :a => (SafeParser::TEST_CONSTANT = 1) }',
+              '{ :a => (hello_world = 1) }']
+      strs.each do |str|
+        assert_raises SafeParser::UnsafeError, "#{ str } should not be safe" do
+          SafeParser.new(str).safe_load
+        end
+      end
+    end
+
+    it "fails if a hash has a method call" do
+      strs = ["{ :a => 2 * 2 }",
+              "{ :a => SOME_CONST }",
+              "{ :a => system('ls /') }",
+              "{ :a => Book.delete_all }",
+              '{ :a => "#{500}" }',
+              '{ :a => "#{ Book.delete_all }" }',
+              '{ :a => refine(UnsafeError) { def safe?; "HAHAHA"; end } }',
+      ]
+      strs.each do |bad_str|
+        assert_raises SafeParser::UnsafeError, "#{ bad_str } should not be safe" do
+          SafeParser.new(bad_str).safe_load
+        end
+      end
+    end
+
+    it "passes for hashes" do
+      strs = ["{}", '{ "a" => "A" }', '{ :a => 123 }', '{ :a => true, :b => false, :c => true, "d" => nil }']
+      parsed = [{}, { "a" => "A" }, { a: 123 }, { a: true, b: false, c: true, "d" => nil }]
+      strs.each.with_index do |good_str, i|
+        assert_equal parsed[i], SafeParser.new(good_str).safe_load, "#{ good_str } should be safe"
+      end
+    end
+
+    it "passes for hashes with sub hashes" do
+      str = '{ :a => [1, 2, { "x" => "y" }] }'
+      parsed = { a: [1, 2, { "x" => "y" }] }
+      assert_equal parsed, SafeParser.new(str).safe_load
+    end
+
+    it "passes for simple literals" do
+      strs = ["1", "'a string'", ":a_symbol", "false", "true", "12.34"]
+      parsed = [1, "a string", :a_symbol, false, true, 12.34]
+      strs.each.with_index do |good_str, i|
+        assert_equal parsed[i], SafeParser.new(good_str).safe_load, "#{ good_str } should be safe"
+      end
+
+      assert_nil SafeParser.new("nil").safe_load, "The string 'nil' should be safe"
+    end
+
+    it "passes for a complex array" do
+      strs = ["[]", "['a_string', :a_symbol, true, false, nil, 1_234_567, 12.34]", "[[123], { a: 1, \"b\" => 2}]"]
+      parsed = [[], ['a_string', :a_symbol, true, false, nil, 1_234_567, 12.34], [[123], { a: 1, "b" => 2}]]
+      strs.each.with_index do |good_str, i|
+        assert_equal parsed[i], SafeParser.new(good_str).safe_load, "#{ good_str } should be safe"
+      end
+    end
+  end
+end
+

metadata

@@ -0,0 +1,113 @@
+--- !ruby/object:Gem::Specification
+name: safe_parser
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Bibek Shrestha
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2017-03-31 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: ruby_parser
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.8.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.8.4
+- !ruby/object:Gem::Dependency
+  name: rdoc
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: hoe
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.16'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.16'
+description: |-
+  Parses a hash string of the format `'{ :a => "something" }'` into an actual ruby hash object `{ a: "something" }`.
+  This is useful when you by mistake serialize hashes and save it in database column or a text file and you want to
+  convert them back to hashes without the security issues of executing `eval(hash_string)`.
+
+  By default only following classes are allowed to be deserialized:
+
+  * TrueClass
+  * FalseClass
+  * NilClass
+  * Numeric
+  * String
+  * Array
+  * Hash
+
+  A HashParser::BadHash exception is thrown if unserializable values are present.
+email:
+- bibekshrestha@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- History.txt
+- Manifest.txt
+- README.txt
+files:
+- History.txt
+- Manifest.txt
+- README.txt
+- Rakefile
+- lib/safe_parser.rb
+- test/test_safe_parser.rb
+homepage: https://github.com/bibstha/ruby_hash_parser
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options:
+- "--main"
+- README.txt
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.10
+signing_key: 
+specification_version: 4
+summary: 'Parses a hash string of the format `''{ :a => "something" }''` into an actual
+  ruby hash object `{ a: "something" }`'
+test_files: []