safemode 2.0.0 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 31ed45049398953b35fafe5ff837df2332712caa9534c5278e971d9031a61836
-  data.tar.gz: 49b507273a0ef6d03578be21a26f26388fb4cd54d253670a8932ae7891ae40f7
+  metadata.gz: 7362759a3432731cdb5b3f8177623fe699b6f78e52922813d0c6af3e280d1b92
+  data.tar.gz: 1f409d13eb5ca31211503168e667e38413cf5f473dece30d7463a099ad9ec751
 SHA512:
-  metadata.gz: eefb3d5121ad93910e1468cd635a5d77320dfbd23c341469af7acc1d90c80947ab1f8ec058bf1775b9269566d2503cfec0118bb6143e9d35ee6ba5afbb055caa
-  data.tar.gz: ab5f0385d055999f6a6463381d24494bab377fe12aebec639b3be5fc78faf4355c5485105ba6c73bbc0a0023c2db3dd063bc35abee19d4564748d15a925650d8
+  metadata.gz: 7adb149b67b9ddd344203a0360ff70e663effb7a0da5ce5506dbac023b12db34a347a59b976cab62c9cf01cdd8cefd28be02c1c3442df787e599eb82bcad0940
+  data.tar.gz: 33a099e1f86a7e9f9c0a14425126a36f332921503ee35bc47e686a7c1deeff301b4b40083c96050ab4d2afa0f354d71204b4429828390cffd75248631eee5d80

data/lib/safemode/blankslate.rb

@@ -1,6 +1,6 @@
 module Safemode
   class Blankslate
-    @@allow_instance_methods = ['class', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
+    @@allow_instance_methods = ['class', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s']
     @@allow_class_methods    = ['singleton_class?', 'methods', 'new', 'name', '<', 'ancestors', '==']  # < needed in Rails Object#subclasses_of
     if defined?(JRUBY_VERSION)
       # JRuby seems to silently fail to remove method_missing

data/lib/safemode/scope.rb

@@ -49,8 +49,10 @@ module Safemode
         end
       end
 
+      IVAR_GET = Object.instance_method(:instance_variable_get)
+
       def unjail(arg)
-        arg.class.name.end_with?('::Jail') ? arg.instance_variable_get(:@source) : arg
+        arg.class.name.end_with?('::Jail') ? IVAR_GET.bind_call(arg, :@source) : arg
       end
 
       def unjail_args(args)

data/safemode.gemspec

@@ -4,7 +4,7 @@ require 'date'
 
 Gem::Specification.new do |s|
   s.name = "safemode".freeze
-  s.version = "2.0.0"
+  s.version = "2.0.2"
   s.date = Date.today
 
   s.summary = "A library for safe evaluation of Ruby code based on Prism and Ruby2Ruby"

data/test/test_jail.rb

@@ -37,7 +37,7 @@ class TestJail < Test::Unit::TestCase
   end
 
   def test_jail_instances_should_have_limited_methods
-    expected = ["class", "method_missing", "methods", "respond_to?", "to_jail", "to_s", "instance_variable_get"]
+    expected = ["class", "method_missing", "methods", "respond_to?", "to_jail", "to_s"]
     objects.each do |object|
       assert_equal expected.sort, reject_pretty_methods(object.to_jail.methods.map(&:to_s).sort)
     end

data/test/test_safemode_eval.rb

@@ -195,6 +195,12 @@ class TestSafemodeEval < Test::Unit::TestCase
     assert_equal "new_value", article.status
   end
 
+  def test_instance_variable_get_blocked_on_jail
+    assert_raise(Safemode::NoMethodError) do
+      @box.eval('@article.instance_variable_get(:@source)', @assigns)
+    end
+  end
+
   def test_lambda_is_blocked
     assert_raise(Safemode::SecurityError) { @box.eval('-> { 1 }') }
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safemode
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.2
 platform: ruby
 authors:
 - Sven Fuchs
@@ -12,7 +12,7 @@ authors:
 - Dmitri Dolguikh
 bindir: bin
 cert_chain: []
-date: 2026-05-21 00:00:00.000000000 Z
+date: 2026-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby2ruby
@@ -165,7 +165,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.20
 specification_version: 4
 summary: A library for safe evaluation of Ruby code based on Prism and Ruby2Ruby
 test_files: []