safemode 2.0.2 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7362759a3432731cdb5b3f8177623fe699b6f78e52922813d0c6af3e280d1b92
-  data.tar.gz: 1f409d13eb5ca31211503168e667e38413cf5f473dece30d7463a099ad9ec751
+  metadata.gz: b2feca54490235c1a1dc543fbdb04ac9d3f81495b8f1126cc4d7b411c71fd963
+  data.tar.gz: 8a2279cf395544183a5947822bf68a1b7cb190caf093544eae667ca79d8423d3
 SHA512:
-  metadata.gz: 7adb149b67b9ddd344203a0360ff70e663effb7a0da5ce5506dbac023b12db34a347a59b976cab62c9cf01cdd8cefd28be02c1c3442df787e599eb82bcad0940
-  data.tar.gz: 33a099e1f86a7e9f9c0a14425126a36f332921503ee35bc47e686a7c1deeff301b4b40083c96050ab4d2afa0f354d71204b4429828390cffd75248631eee5d80
+  metadata.gz: b965556669e1de0b4b966cd7d69a8a55397965a6fbad4b559e91736ed400ccaea3e2f4c50f2dcdef739aa8fb4e2891f927c31a42b471b7b3a2b10020eb981b7c
+  data.tar.gz: a0ea7e3948e167e017e27f1e56a1d3a3ad6d6701368aebcd04a0599ebd89d6aab1fd6328ba2624983852e55bb5c4e654480a90a8249239968caea8766d1eb568

data/lib/safemode/core_jails.rb

@@ -37,7 +37,7 @@ module Safemode
   # these methods are allowed in all classes if they are present
   @@default_methods = %w( % & * ** + +@ - -@ / < << <= <=> ! != == === > >= >> ^ | ~
                           eql? equal? new methods is_a? kind_of? nil?
-                          [] []= to_a to_jail to_s inspect to_param not freeze)
+                          [] []= to_a to_jail to_s inspect to_param not)
 
   # whitelisted methods for core classes ... kind of arbitrary selection
   @@methods_whitelist = {

data/lib/safemode/parser.rb

@@ -24,6 +24,12 @@ module Safemode
     def process_call(exp, safe_call = false)
       _, recv, name, *args = exp
 
+      # ERB emits literal template text as string literals. Freezing one only
+      # affects that template-generated string, not a string passed in by the caller.
+      if name == :freeze && args.empty? && recv && recv.sexp_type == :str
+        return "(#{process recv}).freeze"
+      end
+
       receiver = jail(process_call_receiver(recv), safe_call: safe_call)
       arguments = process_call_args(name, args)
 
@@ -59,9 +65,17 @@ module Safemode
       end
     end
 
+    def process_for(exp)
+      _, recv, iter, body = exp
+      receiver = jail(process(recv), true)
+      variable = process(iter)
+      body = process(body) || '# do nothing'
+      "for #{variable} in #{receiver} do\n#{indent(body)}\nend"
+    end
+
     # see http://www.namikilab.tuat.ac.jp/~sasada/prog/rubynodes/nodes.html
 
-    allowed =    [ :call, :vcall, :evstr,
+    ALLOWED_NODES = [ :call, :safe_call, :fcall, :vcall, :evstr, :const, :arglist,
                    :lvar, :dvar, :ivar, :lasgn, :masgn, :dasgn, :dasgn_curr,
                    :lit, :str, :dstr, :dsym, :nil, :true, :false,
                    :array, :zarray, :hash, :dot2, :dot3, :flip2, :flip3,
@@ -83,7 +97,14 @@ module Safemode
                    # pattern matching (Ruby 3.0+)
                    :in, :array_pat, :hash_pat, :find_pat, :kwrest,
                    # needed for haml
-                   :block ]
+                   :block ].freeze
+
+    def process(exp)
+      if exp && !ALLOWED_NODES.include?(exp.sexp_type)
+        raise_security_error(exp.sexp_type, nil)
+      end
+      super
+    end
 
     disallowed = [ # :self,  # self doesn't seem to be needed for vcalls?
                    # see below for :const handling

data/safemode.gemspec

@@ -4,7 +4,7 @@ require 'date'
 
 Gem::Specification.new do |s|
   s.name = "safemode".freeze
-  s.version = "2.0.2"
+  s.version = "2.0.3"
   s.date = Date.today
 
   s.summary = "A library for safe evaluation of Ruby code based on Prism and Ruby2Ruby"
@@ -49,7 +49,9 @@ Gem::Specification.new do |s|
     "test/test_helper.rb",
     "test/test_jail.rb",
     "test/test_safemode_eval.rb",
-    "test/test_safemode_parser.rb"
+    "test/test_safemode_parser.rb",
+    "test/test_for_loop_jail.rb",
+    "test/test_parser_node_allowlist.rb"
   ]
 
   s.required_ruby_version = ">= 3.0", "< 3.4"

data/test/test_for_loop_jail.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+require_relative 'test_helper'
+
+class TestForLoopJail < Test::Unit::TestCase
+  class Host
+    attr_reader :calls
+
+    def initialize
+      @calls = []
+    end
+
+    def each
+      @calls << :each
+      yield 'secret'
+    end
+  end
+
+  def test_for_loop_checks_each_permission
+    host = Host.new
+    assert_raise(Safemode::NoMethodError) do
+      Safemode::Box.new.eval('for x in @host; x; end', host: host)
+    end
+    assert_empty host.calls
+    assert_equal 3, Safemode::Box.new.eval('sum = 0; for x in [1, 2]; sum += x; end; sum')
+    assert_equal 2, Safemode::Box.new.eval('for x in [1, 2]; end; x')
+  end
+end

data/test/test_parser_node_allowlist.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+require_relative 'test_helper'
+
+class TestParserNodeAllowlist < Test::Unit::TestCase
+  def test_new_dependency_node_handlers_are_not_implicitly_trusted
+    parser = Class.new(Safemode::Parser) do
+      def process_unreviewed_node(exp)
+        '42'
+      end
+    end
+    assert_raise(Safemode::SecurityError) { parser.new.process(Sexp.new(:unreviewed_node)) }
+  end
+end

data/test/test_safemode_eval.rb

@@ -201,6 +201,20 @@ class TestSafemodeEval < Test::Unit::TestCase
     end
   end
 
+  def test_freeze_on_jailed_object_is_blocked
+    string = String.new('host value')
+    assert_raise(Safemode::NoMethodError) { @box.eval('@value.freeze', value: string) }
+    assert_false string.frozen?
+    assert_raise(Safemode::NoMethodError) do
+      @box.eval('@arr.freeze', { arr: [1, 2, 3] })
+    end
+  end
+
+  def test_freeze_on_literal_strings_supports_erb
+    assert_predicate @box.eval('"literal".freeze'), :frozen?
+    assert_equal 'Hello world', @box.eval(ERB.new('Hello <%= @name %>').src, name: 'world')
+  end
+
   def test_lambda_is_blocked
     assert_raise(Safemode::SecurityError) { @box.eval('-> { 1 }') }
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safemode
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.0.3
 platform: ruby
 authors:
 - Sven Fuchs
@@ -12,7 +12,7 @@ authors:
 - Dmitri Dolguikh
 bindir: bin
 cert_chain: []
-date: 2026-10-01 00:00:00.000000000 Z
+date: 2026-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby2ruby
@@ -140,8 +140,10 @@ files:
 - lib/safemode/scope.rb
 - safemode.gemspec
 - test/test_erb_eval.rb
+- test/test_for_loop_jail.rb
 - test/test_helper.rb
 - test/test_jail.rb
+- test/test_parser_node_allowlist.rb
 - test/test_safemode_eval.rb
 - test/test_safemode_parser.rb
 homepage: https://github.com/svenfuchs/safemode