safemode 1.2.0 → 1.2.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 29e339575c91027bf2680aa33c98b8f6c13024b5
+  data.tar.gz: 135d1097eea7885b5930241401353a3d38376c5d
+SHA512:
+  metadata.gz: fd43ddc3f3525dc737365792cc34f9521ef54d338f6d2ea3f33aabf8dc1dc6048d9766e02ca9bac04ba200e0ded1b6fa9753ea162257324ebcca29860358a103
+  data.tar.gz: 7a44ab0d645b2dc170c27d43880f45c61783a84469892eb5a5c10ea92c0d9b91bdc3ef6c9c56d771315686ae5bc0be8319f05a6b899095ea33d10c2e52932e6a

data/VERSION

@@ -1 +1 @@
-1.2.0
+1.2.1

data/lib/safemode/blankslate.rb

@@ -1,6 +1,6 @@
 module Safemode
   class Blankslate
-    @@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'to_s', 'instance_variable_get']
+    @@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
     @@allow_class_methods    = ['methods', 'new', 'name', 'inspect', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
 
     silently { undef_methods(*instance_methods.map(&:to_s) - @@allow_instance_methods) }

data/lib/safemode/core_jails.rb

@@ -1,35 +1,34 @@
-module Safemode      
+module Safemode
   class << self
-    def define_core_jail_classes        
+    def define_core_jail_classes
       core_classes.each do |klass|
         define_jail_class(klass).allow *core_jail_methods(klass).uniq
       end
     end
-  
+
     def define_jail_class(klass)
       unless klass.const_defined?("Jail")
         klass.const_set("Jail", jail = Class.new(Safemode::Jail))
       end
-      klass.const_get('Jail')          
+      klass.const_get('Jail')
     end
-    
+
     def core_classes
-      klasses = [ Array, Bignum, Fixnum, Float, Hash, 
-                  Range, String, Symbol, Time ]
+      klasses = [ Array, Bignum, Fixnum, Float, Hash, Range, String, Symbol, Time, NilClass, FalseClass, TrueClass ]
       klasses << Date if defined? Date
       klasses << DateTime if defined? DateTime
       klasses
     end
-    
+
     def core_jail_methods(klass)
       @@methods_whitelist[klass.name] + (@@default_methods & klass.instance_methods.map(&:to_s))
     end
   end
-  
+
   # these methods are allowed in all classes if they are present
-  @@default_methods = %w( % & * ** + +@ - -@ / < << <= <=> != == === > >= >> ^ | ~
+  @@default_methods = %w( % & * ** + +@ - -@ / < << <= <=> ! != == === > >= >> ^ | ~
                           eql? equal? new methods is_a? kind_of? nil? 
-                          [] []= to_a to_jail to_s inspect to_param )
+                          [] []= to_a to_jail to_s inspect to_param not)
 
   # whitelisted methods for core classes ... kind of arbitrary selection
   @@methods_whitelist = {
@@ -55,16 +54,16 @@ module Safemode
                     infinite? integer? modulo nan? nonzero? quo remainder
                     round singleton_method_added step to_f to_i to_int to_s
                     truncate zero?),
-                    
+
     'Hash'       => %w(blank? clear delete delete_if each each_key each_pair
                     each_value empty? fetch has_key? has_value? include? index
                     invert key? keys length member? merge merge! rec_merge! rehash
                     reject reject! select shift size sort store
                     update value? values values_at),
-           
+
     'Range'      => %w(begin each end exclude_end? first hash include?
                     include_without_range? last member? step),
-           
+
     'String'     => %w(blank? capitalize capitalize! casecmp center chomp chomp!
                     chop chop! concat count crypt delete delete! downcase
                     downcase! dump each_byte each_line empty? end_with? force_encoding gsub
@@ -77,14 +76,14 @@ module Safemode
                     upcase upcase! upto),
            
     'Symbol'     => %w(to_i to_int),
-           
+
     'Time'       => %w(_dump asctime ctime day dst? getgm getlocal getutc gmt?
                     gmt_offset gmtime gmtoff hash hour httpdate isdst iso8601
                     localtime mday min minus_without_duration mon month
                     plus_without_duration rfc2822 rfc822 sec strftime succ to_date
                     to_datetime to_f to_i tv_sec tv_usec usec utc utc? utc_offset
                     wday xmlschema yday year zone to_formatted_s),
-           
+
     'Date'       => %w(ajd amjd asctime ctime cwday cweek cwyear day day_fraction
                     default_inspect downto england gregorian gregorian? hash italy
                     jd julian julian? ld leap? mday minus_without_duration mjd mon
@@ -93,12 +92,11 @@ module Safemode
 
     'DateTime'   => %w(hour, min, new_offset, newof, of, offset, sec, 
                     sec_fraction, strftime, to_datetime_default_s, to_json, zone),
-    
+
     'NilClass'   => %w(blank? duplicable? to_f to_i),
-           
+
     'FalseClass' => %w(blank? duplicable?),
-    
-    'TrueClass'  => %w(blank? duplicable?)
-           
-  }    
+
+    'TrueClass'  => %w(blank? duplicable?)           
+  } 
 end

data/lib/safemode/jail.rb

@@ -24,5 +24,14 @@ module Safemode
       # statement, passing them to a Rails helper etc.
       @source.send(method, *args, &block)
     end
+
+    # needed for compatibility with 1.8.7; remove this method once 1.8.7 support has been dropped
+    def respond_to?(method, *)
+      respond_to_missing?(method)
+    end
+
+    def respond_to_missing?(method_name, include_private = false)
+      self.class.allowed?(method_name)
+    end
   end
 end

data/safemode.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = "safemode"
-  s.version = "1.2.0"
+  s.version = "1.2.1"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Sven Fuchs", "Peter Cooper", "Matthias Viehweger", "Kingsley Hendrickse", "Ohad Levy", "Dmitri Dolguikh"]

data/test/test_jail.rb

@@ -19,7 +19,7 @@ class TestJail < Test::Unit::TestCase
   end
 
   def test_jail_instances_should_have_limited_methods
-    expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "to_jail", "to_s", "instance_variable_get"]
+    expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
     objects.each do |object|
       assert_equal expected.sort, reject_pretty_methods(object.to_jail.methods.map(&:to_s).sort)
     end
@@ -40,6 +40,11 @@ class TestJail < Test::Unit::TestCase
     assert_equal Article::Jail.allowed_methods, Article::ExtendedJail.allowed_methods
   end
 
+  def test_respond_to_works_correctly
+    assert @article.respond_to?(:title)
+    assert !@article.respond_to?(:bogus)
+  end
+
   private
 
   def objects

data/test/test_safemode_eval.rb

@@ -16,7 +16,42 @@ class TestSafemodeEval < Test::Unit::TestCase
       assert_nothing_raised{ @box.eval code }
     end
   end
-  
+
+  def test_unary_operators_on_instances_of_boolean_vars
+    if RUBY_VERSION != "1.8.7"
+      assert @box.eval('not false')
+      assert @box.eval('!false')
+      assert !@box.eval('not true')
+      assert !@box.eval('!true')
+    else
+      p "no unary ops under 1.8.7!"
+    end
+  end
+
+  def test_false_class_ops
+    assert !@box.eval('false ^ false')
+    assert !@box.eval('false & false')
+    assert !@box.eval('false && false')
+    assert !@box.eval('false and false')
+    assert !@box.eval('false | false')
+    assert !@box.eval('false || false')
+    assert !@box.eval('false or false')
+    assert @box.eval('false == false')
+    assert @box.eval('false != true')
+  end
+
+  def test_true_class_ops
+    assert !@box.eval('true ^ true')
+    assert @box.eval('true & true')
+    assert @box.eval('true && true')
+    assert @box.eval('true and true')
+    assert @box.eval('true | true')
+    assert @box.eval('true || true')
+    assert @box.eval('true or true')
+    assert @box.eval('true == true')
+    assert @box.eval('true != false')
+  end
+
   def test_should_turn_assigns_to_jails
     assert_raise_no_method "@article.system", @assigns
   end

metadata

@@ -1,8 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safemode
 version: !ruby/object:Gem::Version
-  version: 1.2.0
-  prerelease: 
+  version: 1.2.1
 platform: ruby
 authors:
 - Sven Fuchs
@@ -19,71 +18,62 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: sexp_processor
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 4.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 4.1.2
 - !ruby/object:Gem::Dependency
   name: ruby2ruby
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 2.0.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 2.0.1
 - !ruby/object:Gem::Dependency
   name: ruby_parser
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 3.0.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: 3.0.1
 - !ruby/object:Gem::Dependency
   name: shoulda
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -91,7 +81,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -99,7 +88,6 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -107,7 +95,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -115,7 +102,6 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: jeweler
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -123,7 +109,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -131,65 +116,57 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: rcov
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 description: A library for safe evaluation of Ruby code based on RubyParser and Ruby2Ruby.
@@ -232,28 +209,24 @@ files:
 homepage: http://github.com/svenfuchs/safemode
 licenses:
 - MIT
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
-      segments:
-      - 0
-      hash: -3228505214304288424
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.24
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 3
 summary: A library for safe evaluation of Ruby code based on ParseTree/RubyParser