safemode 1.0.2 → 1.1.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of safemode might be problematic. Click here for more details.
- data/Gemfile +7 -4
- data/Gemfile.lock +30 -16
- data/README.markdown +1 -0
- data/Rakefile +15 -6
- data/VERSION +1 -1
- data/lib/safemode/blankslate.rb +2 -2
- data/lib/safemode/core_jails.rb +6 -5
- data/lib/safemode/jail.rb +0 -4
- data/lib/safemode/parser.rb +25 -12
- data/lib/safemode/scope.rb +3 -3
- data/safemode.gemspec +22 -13
- data/test/test_erb_eval.rb +2 -2
- data/test/test_helper.rb +9 -0
- data/test/test_jail.rb +2 -7
- data/test/test_safemode_eval.rb +2 -33
- metadata +92 -22
- checksums.yaml +0 -7
data/Gemfile
CHANGED
@@ -1,15 +1,18 @@
|
|
1
1
|
source "http://rubygems.org"
|
2
2
|
|
3
|
-
gem "
|
4
|
-
gem "
|
3
|
+
gem 'sexp_processor', ">= 4.1.2"
|
4
|
+
gem 'ruby2ruby', ">= 2.0.1"
|
5
|
+
gem "ruby_parser", ">= 3.0.1"
|
5
6
|
|
6
7
|
# Add dependencies to develop your gem here.
|
7
8
|
# Include everything needed to run rake, tests, features, etc.
|
8
9
|
group :development do
|
9
10
|
gem "shoulda", ">= 0"
|
10
11
|
gem "rdoc", "~> 3.12"
|
11
|
-
gem "bundler", "~> 1.0
|
12
|
+
gem "bundler", "~> 1.0"
|
12
13
|
gem "jeweler", "~> 1.8.3"
|
13
|
-
gem "rcov",
|
14
|
+
gem "rcov", :platforms => :ruby_18
|
15
|
+
gem "simplecov", :platforms => :ruby_19
|
16
|
+
gem "test-unit", :platforms => :ruby_19
|
14
17
|
gem "rake"
|
15
18
|
end
|
data/Gemfile.lock
CHANGED
@@ -1,38 +1,52 @@
|
|
1
1
|
GEM
|
2
2
|
remote: http://rubygems.org/
|
3
3
|
specs:
|
4
|
+
activesupport (3.2.8)
|
5
|
+
i18n (~> 0.6)
|
6
|
+
multi_json (~> 1.0)
|
4
7
|
git (1.2.5)
|
5
|
-
|
8
|
+
i18n (0.6.1)
|
9
|
+
jeweler (1.8.4)
|
6
10
|
bundler (~> 1.0)
|
7
11
|
git (>= 1.2.5)
|
8
12
|
rake
|
9
13
|
rdoc
|
10
|
-
json (1.
|
14
|
+
json (1.7.5)
|
15
|
+
multi_json (1.3.6)
|
11
16
|
rake (0.9.2.2)
|
12
17
|
rcov (1.0.0)
|
13
18
|
rdoc (3.12)
|
14
19
|
json (~> 1.4)
|
15
|
-
ruby2ruby (
|
16
|
-
ruby_parser (~>
|
17
|
-
sexp_processor (~>
|
18
|
-
ruby_parser (
|
19
|
-
sexp_processor (~>
|
20
|
-
sexp_processor (
|
21
|
-
shoulda (3.
|
22
|
-
shoulda-context (~> 1.0.
|
23
|
-
shoulda-matchers (~> 1.
|
24
|
-
shoulda-context (1.0.
|
25
|
-
shoulda-matchers (1.
|
20
|
+
ruby2ruby (2.0.1)
|
21
|
+
ruby_parser (~> 3.0.0)
|
22
|
+
sexp_processor (~> 4.0)
|
23
|
+
ruby_parser (3.0.1)
|
24
|
+
sexp_processor (~> 4.1)
|
25
|
+
sexp_processor (4.1.2)
|
26
|
+
shoulda (3.3.2)
|
27
|
+
shoulda-context (~> 1.0.1)
|
28
|
+
shoulda-matchers (~> 1.4.1)
|
29
|
+
shoulda-context (1.0.1)
|
30
|
+
shoulda-matchers (1.4.1)
|
31
|
+
activesupport (>= 3.0.0)
|
32
|
+
simplecov (0.7.1)
|
33
|
+
multi_json (~> 1.0)
|
34
|
+
simplecov-html (~> 0.7.1)
|
35
|
+
simplecov-html (0.7.1)
|
36
|
+
test-unit (2.5.2)
|
26
37
|
|
27
38
|
PLATFORMS
|
28
39
|
ruby
|
29
40
|
|
30
41
|
DEPENDENCIES
|
31
|
-
bundler (~> 1.0
|
42
|
+
bundler (~> 1.0)
|
32
43
|
jeweler (~> 1.8.3)
|
33
44
|
rake
|
34
45
|
rcov
|
35
46
|
rdoc (~> 3.12)
|
36
|
-
ruby2ruby
|
37
|
-
ruby_parser
|
47
|
+
ruby2ruby (>= 2.0.1)
|
48
|
+
ruby_parser (>= 3.0.1)
|
49
|
+
sexp_processor (>= 4.1.2)
|
38
50
|
shoulda
|
51
|
+
simplecov
|
52
|
+
test-unit
|
data/README.markdown
CHANGED
@@ -72,6 +72,7 @@ See lib/ruby\_parser\_string\_io\_patch.diff
|
|
72
72
|
* Matthias Viehweger
|
73
73
|
* Ohad Levy
|
74
74
|
* Kingsley Hendrickse
|
75
|
+
* Dmitri Dolguikh
|
75
76
|
|
76
77
|
This code and all of the Safemode library's code was initially written by
|
77
78
|
Sven Fuchs to allow Haml to have a safe mode. It was then modified and
|
data/Rakefile
CHANGED
@@ -34,6 +34,7 @@ Jeweler::Tasks.new do |gem|
|
|
34
34
|
"Matthias Viehweger",
|
35
35
|
"Kingsley Hendrickse",
|
36
36
|
"Ohad Levy",
|
37
|
+
"Dmitri Dolguikh",
|
37
38
|
]
|
38
39
|
# dependencies defined in Gemfile
|
39
40
|
end
|
@@ -46,12 +47,20 @@ Rake::TestTask.new(:test) do |test|
|
|
46
47
|
test.verbose = true
|
47
48
|
end
|
48
49
|
|
49
|
-
|
50
|
-
|
51
|
-
|
52
|
-
|
53
|
-
|
54
|
-
|
50
|
+
if RUBY_VERSION >= "1.9"
|
51
|
+
desc "Generate coverage report for tests"
|
52
|
+
task :coverage do |cov|
|
53
|
+
ENV['COVERAGE'] = 'true'
|
54
|
+
Rake::Task[:test].execute
|
55
|
+
end
|
56
|
+
else
|
57
|
+
require 'rcov/rcovtask'
|
58
|
+
Rcov::RcovTask.new do |test|
|
59
|
+
test.libs << 'test'
|
60
|
+
test.pattern = 'test/**/test_*.rb'
|
61
|
+
test.verbose = true
|
62
|
+
test.rcov_opts << '--exclude "gems/*"'
|
63
|
+
end
|
55
64
|
end
|
56
65
|
|
57
66
|
task :default => :test
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
1.0
|
1
|
+
1.1.0
|
data/lib/safemode/blankslate.rb
CHANGED
@@ -3,9 +3,9 @@ module Safemode
|
|
3
3
|
@@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'to_s', 'instance_variable_get']
|
4
4
|
@@allow_class_methods = ['methods', 'new', 'name', 'inspect', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
|
5
5
|
|
6
|
-
silently { undef_methods(*instance_methods - @@allow_instance_methods) }
|
6
|
+
silently { undef_methods(*instance_methods.map(&:to_s) - @@allow_instance_methods) }
|
7
7
|
class << self
|
8
|
-
silently { undef_methods(*instance_methods - @@allow_class_methods) }
|
8
|
+
silently { undef_methods(*instance_methods.map(&:to_s) - @@allow_class_methods) }
|
9
9
|
|
10
10
|
def method_added(name) end # ActiveSupport needs this
|
11
11
|
|
data/lib/safemode/core_jails.rb
CHANGED
@@ -14,21 +14,22 @@ module Safemode
|
|
14
14
|
end
|
15
15
|
|
16
16
|
def core_classes
|
17
|
-
klasses = [ Array, Bignum, Fixnum, Float, Hash,
|
17
|
+
klasses = [ Array, Bignum, Fixnum, Float, Hash,
|
18
|
+
Range, String, Symbol, Time ]
|
18
19
|
klasses << Date if defined? Date
|
19
20
|
klasses << DateTime if defined? DateTime
|
20
21
|
klasses
|
21
22
|
end
|
22
23
|
|
23
24
|
def core_jail_methods(klass)
|
24
|
-
@@methods_whitelist[klass.name] + (@@default_methods & klass.instance_methods)
|
25
|
+
@@methods_whitelist[klass.name] + (@@default_methods & klass.instance_methods.map(&:to_s))
|
25
26
|
end
|
26
27
|
end
|
27
28
|
|
28
29
|
# these methods are allowed in all classes if they are present
|
29
|
-
@@default_methods = %w( % & * ** + +@ - -@ / < << <= <=>
|
30
|
+
@@default_methods = %w( % & * ** + +@ - -@ / < << <= <=> == === > >= >> ^ | ~
|
30
31
|
eql? equal? new methods is_a? kind_of? nil?
|
31
|
-
[] []= to_a to_jail to_s inspect to_param
|
32
|
+
[] []= to_a to_jail to_s inspect to_param )
|
32
33
|
|
33
34
|
# whitelisted methods for core classes ... kind of arbitrary selection
|
34
35
|
@@methods_whitelist = {
|
@@ -66,7 +67,7 @@ module Safemode
|
|
66
67
|
|
67
68
|
'String' => %w(blank? capitalize capitalize! casecmp center chomp chomp!
|
68
69
|
chop chop! concat count crypt delete delete! downcase
|
69
|
-
downcase! dump
|
70
|
+
downcase! dump each_byte each_line empty? end_with? force_encoding gsub
|
70
71
|
gsub! hash hex include? index insert intern iseuc issjis
|
71
72
|
isutf8 kconv length ljust lstrip lstrip! match next next! oct
|
72
73
|
reverse reverse! rindex rjust rstrip rstrip! scan size slice
|
data/lib/safemode/jail.rb
CHANGED
data/lib/safemode/parser.rb
CHANGED
@@ -36,7 +36,7 @@ module Safemode
|
|
36
36
|
receiver = jail process_call_receiver(exp)
|
37
37
|
name = exp.shift
|
38
38
|
args = process_call_args(exp)
|
39
|
-
process_call_code(receiver, name, args)
|
39
|
+
process_call_code(receiver, name, args)
|
40
40
|
end
|
41
41
|
|
42
42
|
def process_fcall(exp)
|
@@ -79,6 +79,8 @@ module Safemode
|
|
79
79
|
:iasgn, # iasgn is sometimes allowed
|
80
80
|
# not sure about self ...
|
81
81
|
:self,
|
82
|
+
# :args is now used for block parameters
|
83
|
+
:args,
|
82
84
|
# unnecessarily advanced?
|
83
85
|
:argscat, :argspush, :splat, :block_pass,
|
84
86
|
:op_asgn1, :op_asgn2, :op_asgn_and, :op_asgn_or,
|
@@ -86,9 +88,10 @@ module Safemode
|
|
86
88
|
:block ]
|
87
89
|
|
88
90
|
disallowed = [ # :self, # self doesn't seem to be needed for vcalls?
|
89
|
-
|
91
|
+
# see below for :const handling
|
92
|
+
:defn, :defs, :alias, :valias, :undef, :class, :attrset,
|
90
93
|
:module, :sclass, :colon2, :colon3,
|
91
|
-
:fbody, :scope,
|
94
|
+
:fbody, :scope, :block_arg, :postexe,
|
92
95
|
:redo, :retry, :begin, :rescue, :resbody, :ensure,
|
93
96
|
:defined, :super, :zsuper, :return,
|
94
97
|
:dmethod, :bmethod, :to_ary, :svalue, :match,
|
@@ -102,11 +105,18 @@ module Safemode
|
|
102
105
|
# :ifunc, :method, :last, :opt_n, :cfunc, :newline, :alloca, :memo, :cref
|
103
106
|
|
104
107
|
disallowed.each do |name|
|
105
|
-
define_method "process_#{name}" do
|
106
|
-
code = super
|
108
|
+
define_method "process_#{name}" do |arg|
|
109
|
+
code = super(arg)
|
107
110
|
raise_security_error(name, code)
|
108
111
|
end
|
109
112
|
end
|
113
|
+
|
114
|
+
# handling of Encoding constants in ruby 1.9.
|
115
|
+
# Note: ruby_parser evaluates __ENCODING__ to :const Encoding::UTF_8
|
116
|
+
def process_const(arg)
|
117
|
+
raise_security_error("constant", super(arg)) unless (RUBY_VERSION >= "1.9" and arg.sexp_type.class == Encoding)
|
118
|
+
"Encoding::#{super(arg).gsub('-', '_')}"
|
119
|
+
end
|
110
120
|
|
111
121
|
def raise_security_error(type, info)
|
112
122
|
raise Safemode::SecurityError.new(type, info)
|
@@ -124,14 +134,17 @@ module Safemode
|
|
124
134
|
end
|
125
135
|
|
126
136
|
def process_call_args(exp)
|
127
|
-
|
128
|
-
|
129
|
-
|
130
|
-
|
131
|
-
|
132
|
-
|
137
|
+
args = []
|
138
|
+
while not exp.empty? do
|
139
|
+
args_exp = exp.shift
|
140
|
+
if args_exp && args_exp.first == :array # FIX
|
141
|
+
processed = "#{process(args_exp)[1..-2]}"
|
142
|
+
else
|
143
|
+
processed = process args_exp
|
144
|
+
end
|
145
|
+
args << processed unless (processed.nil? or processed.empty?)
|
133
146
|
end
|
134
|
-
args
|
147
|
+
args.empty? ? nil : args.join(", ")
|
135
148
|
end
|
136
149
|
|
137
150
|
def process_call_code(receiver, name, args)
|
data/lib/safemode/scope.rb
CHANGED
@@ -29,10 +29,10 @@ module Safemode
|
|
29
29
|
def output
|
30
30
|
@_safemode_output
|
31
31
|
end
|
32
|
-
|
32
|
+
|
33
33
|
def method_missing(method, *args, &block)
|
34
34
|
if @locals.has_key?(method)
|
35
|
-
@locals[method]
|
35
|
+
@locals[method]
|
36
36
|
elsif @delegate_methods.include?(method)
|
37
37
|
@delegate.send method, *unjail_args(args), &block
|
38
38
|
else
|
@@ -54,5 +54,5 @@ module Safemode
|
|
54
54
|
arg.class.name =~ /::Jail$/ ? arg.instance_variable_get(:@source) : arg
|
55
55
|
end
|
56
56
|
end
|
57
|
-
end
|
57
|
+
end
|
58
58
|
end
|
data/safemode.gemspec
CHANGED
@@ -5,11 +5,11 @@
|
|
5
5
|
|
6
6
|
Gem::Specification.new do |s|
|
7
7
|
s.name = "safemode"
|
8
|
-
s.version = "1.0
|
8
|
+
s.version = "1.1.0"
|
9
9
|
|
10
10
|
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
11
|
-
s.authors = ["Sven Fuchs", "Peter Cooper", "Matthias Viehweger", "Kingsley Hendrickse", "Ohad Levy"]
|
12
|
-
s.date = "2012-
|
11
|
+
s.authors = ["Sven Fuchs", "Peter Cooper", "Matthias Viehweger", "Kingsley Hendrickse", "Ohad Levy", "Dmitri Dolguikh"]
|
12
|
+
s.date = "2012-12-10"
|
13
13
|
s.description = "A library for safe evaluation of Ruby code based on RubyParser and Ruby2Ruby. Provides Rails ActionView template handlers for ERB and Haml."
|
14
14
|
s.email = "ohadlevy@gmail.com"
|
15
15
|
s.extra_rdoc_files = [
|
@@ -49,39 +49,48 @@ Gem::Specification.new do |s|
|
|
49
49
|
s.homepage = "http://github.com/svenfuchs/safemode"
|
50
50
|
s.licenses = ["MIT"]
|
51
51
|
s.require_paths = ["lib"]
|
52
|
-
s.rubygems_version = "1.8.
|
52
|
+
s.rubygems_version = "1.8.24"
|
53
53
|
s.summary = "A library for safe evaluation of Ruby code based on ParseTree/RubyParser and Ruby2Ruby"
|
54
54
|
|
55
55
|
if s.respond_to? :specification_version then
|
56
56
|
s.specification_version = 3
|
57
57
|
|
58
58
|
if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
|
59
|
-
s.add_runtime_dependency(%q<
|
60
|
-
s.add_runtime_dependency(%q<
|
59
|
+
s.add_runtime_dependency(%q<sexp_processor>, [">= 4.1.2"])
|
60
|
+
s.add_runtime_dependency(%q<ruby2ruby>, [">= 2.0.1"])
|
61
|
+
s.add_runtime_dependency(%q<ruby_parser>, [">= 3.0.1"])
|
61
62
|
s.add_development_dependency(%q<shoulda>, [">= 0"])
|
62
63
|
s.add_development_dependency(%q<rdoc>, ["~> 3.12"])
|
63
|
-
s.add_development_dependency(%q<bundler>, ["~> 1.0
|
64
|
+
s.add_development_dependency(%q<bundler>, ["~> 1.0"])
|
64
65
|
s.add_development_dependency(%q<jeweler>, ["~> 1.8.3"])
|
65
66
|
s.add_development_dependency(%q<rcov>, [">= 0"])
|
67
|
+
s.add_development_dependency(%q<simplecov>, [">= 0"])
|
68
|
+
s.add_development_dependency(%q<test-unit>, [">= 0"])
|
66
69
|
s.add_development_dependency(%q<rake>, [">= 0"])
|
67
70
|
else
|
68
|
-
s.add_dependency(%q<
|
69
|
-
s.add_dependency(%q<
|
71
|
+
s.add_dependency(%q<sexp_processor>, [">= 4.1.2"])
|
72
|
+
s.add_dependency(%q<ruby2ruby>, [">= 2.0.1"])
|
73
|
+
s.add_dependency(%q<ruby_parser>, [">= 3.0.1"])
|
70
74
|
s.add_dependency(%q<shoulda>, [">= 0"])
|
71
75
|
s.add_dependency(%q<rdoc>, ["~> 3.12"])
|
72
|
-
s.add_dependency(%q<bundler>, ["~> 1.0
|
76
|
+
s.add_dependency(%q<bundler>, ["~> 1.0"])
|
73
77
|
s.add_dependency(%q<jeweler>, ["~> 1.8.3"])
|
74
78
|
s.add_dependency(%q<rcov>, [">= 0"])
|
79
|
+
s.add_dependency(%q<simplecov>, [">= 0"])
|
80
|
+
s.add_dependency(%q<test-unit>, [">= 0"])
|
75
81
|
s.add_dependency(%q<rake>, [">= 0"])
|
76
82
|
end
|
77
83
|
else
|
78
|
-
s.add_dependency(%q<
|
79
|
-
s.add_dependency(%q<
|
84
|
+
s.add_dependency(%q<sexp_processor>, [">= 4.1.2"])
|
85
|
+
s.add_dependency(%q<ruby2ruby>, [">= 2.0.1"])
|
86
|
+
s.add_dependency(%q<ruby_parser>, [">= 3.0.1"])
|
80
87
|
s.add_dependency(%q<shoulda>, [">= 0"])
|
81
88
|
s.add_dependency(%q<rdoc>, ["~> 3.12"])
|
82
|
-
s.add_dependency(%q<bundler>, ["~> 1.0
|
89
|
+
s.add_dependency(%q<bundler>, ["~> 1.0"])
|
83
90
|
s.add_dependency(%q<jeweler>, ["~> 1.8.3"])
|
84
91
|
s.add_dependency(%q<rcov>, [">= 0"])
|
92
|
+
s.add_dependency(%q<simplecov>, [">= 0"])
|
93
|
+
s.add_dependency(%q<test-unit>, [">= 0"])
|
85
94
|
s.add_dependency(%q<rake>, [">= 0"])
|
86
95
|
end
|
87
96
|
end
|
data/test/test_erb_eval.rb
CHANGED
@@ -1,6 +1,6 @@
|
|
1
1
|
require File.join(File.dirname(__FILE__), 'test_helper')
|
2
2
|
|
3
|
-
class
|
3
|
+
class TestERBEval < Test::Unit::TestCase
|
4
4
|
include TestHelper
|
5
5
|
|
6
6
|
def setup
|
@@ -73,4 +73,4 @@ class TestSafemodeEval < Test::Unit::TestCase
|
|
73
73
|
)
|
74
74
|
end
|
75
75
|
|
76
|
-
end
|
76
|
+
end
|
data/test/test_helper.rb
CHANGED
@@ -1,3 +1,8 @@
|
|
1
|
+
if RUBY_VERSION >= '1.9'and ENV['COVERAGE']
|
2
|
+
require 'simplecov'
|
3
|
+
SimpleCov.start {add_filter 'test_'}
|
4
|
+
end
|
5
|
+
|
1
6
|
$LOAD_PATH << File.join(File.dirname(__FILE__), '..', 'lib')
|
2
7
|
|
3
8
|
require 'rubygems'
|
@@ -96,6 +101,10 @@ class Article
|
|
96
101
|
def comments
|
97
102
|
[Comment.new(self), Comment.new(self)]
|
98
103
|
end
|
104
|
+
|
105
|
+
def method_missing(method, *args, &block)
|
106
|
+
super(method, *args, &block)
|
107
|
+
end
|
99
108
|
end
|
100
109
|
|
101
110
|
class Comment
|
data/test/test_jail.rb
CHANGED
@@ -21,7 +21,7 @@ class TestJail < Test::Unit::TestCase
|
|
21
21
|
def test_jail_instances_should_have_limited_methods
|
22
22
|
expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "to_jail", "to_s", "instance_variable_get"]
|
23
23
|
objects.each do |object|
|
24
|
-
assert_equal expected.sort, reject_pretty_methods(object.to_jail.methods.sort)
|
24
|
+
assert_equal expected.sort, reject_pretty_methods(object.to_jail.methods.map(&:to_s).sort)
|
25
25
|
end
|
26
26
|
end
|
27
27
|
|
@@ -32,7 +32,7 @@ class TestJail < Test::Unit::TestCase
|
|
32
32
|
"ancestors", "==" # ancestors and == needed in Rails::Generator::Spec#lookup_class
|
33
33
|
]
|
34
34
|
objects.each do |object|
|
35
|
-
assert_equal expected.sort, reject_pretty_methods(object.to_jail.class.methods.sort)
|
35
|
+
assert_equal expected.sort, reject_pretty_methods(object.to_jail.class.methods.map(&:to_s).sort)
|
36
36
|
end
|
37
37
|
end
|
38
38
|
|
@@ -40,11 +40,6 @@ class TestJail < Test::Unit::TestCase
|
|
40
40
|
assert_equal Article::Jail.allowed_methods, Article::ExtendedJail.allowed_methods
|
41
41
|
end
|
42
42
|
|
43
|
-
def test_respond_to_works_correctly
|
44
|
-
assert @article.respond_to?(:title)
|
45
|
-
assert !@article.respond_to?(:bogus)
|
46
|
-
end
|
47
|
-
|
48
43
|
private
|
49
44
|
|
50
45
|
def objects
|
data/test/test_safemode_eval.rb
CHANGED
@@ -14,38 +14,7 @@ class TestSafemodeEval < Test::Unit::TestCase
|
|
14
14
|
assert_nothing_raised{ @box.eval code }
|
15
15
|
end
|
16
16
|
end
|
17
|
-
|
18
|
-
def test_unary_operators_on_instances_of_boolean_vars
|
19
|
-
assert @box.eval('not false')
|
20
|
-
assert @box.eval('!false')
|
21
|
-
assert !@box.eval('not true')
|
22
|
-
assert !@box.eval('!true')
|
23
|
-
end
|
24
|
-
|
25
|
-
def test_false_class_ops
|
26
|
-
assert !@box.eval('false ^ false')
|
27
|
-
assert !@box.eval('false & false')
|
28
|
-
assert !@box.eval('false && false')
|
29
|
-
assert !@box.eval('false and false')
|
30
|
-
assert !@box.eval('false | false')
|
31
|
-
assert !@box.eval('false || false')
|
32
|
-
assert !@box.eval('false or false')
|
33
|
-
assert @box.eval('false == false')
|
34
|
-
assert @box.eval('false != true')
|
35
|
-
end
|
36
|
-
|
37
|
-
def test_true_class_ops
|
38
|
-
assert !@box.eval('true ^ true')
|
39
|
-
assert @box.eval('true & true')
|
40
|
-
assert @box.eval('true && true')
|
41
|
-
assert @box.eval('true and true')
|
42
|
-
assert @box.eval('true | true')
|
43
|
-
assert @box.eval('true || true')
|
44
|
-
assert @box.eval('true or true')
|
45
|
-
assert @box.eval('true == true')
|
46
|
-
assert @box.eval('true != false')
|
47
|
-
end
|
48
|
-
|
17
|
+
|
49
18
|
def test_should_turn_assigns_to_jails
|
50
19
|
assert_raise_no_method "@article.system", @assigns
|
51
20
|
end
|
@@ -59,7 +28,7 @@ class TestSafemodeEval < Test::Unit::TestCase
|
|
59
28
|
end
|
60
29
|
|
61
30
|
def test_should_allow_method_access_on_locals
|
62
|
-
assert_nothing_raised{ @box.eval
|
31
|
+
assert_nothing_raised{ @box.eval("article.title", {}, @locals) }
|
63
32
|
end
|
64
33
|
|
65
34
|
def test_should_not_raise_on_if_using_return_values
|
metadata
CHANGED
@@ -1,7 +1,8 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: safemode
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.0
|
4
|
+
version: 1.1.0
|
5
|
+
prerelease:
|
5
6
|
platform: ruby
|
6
7
|
authors:
|
7
8
|
- Sven Fuchs
|
@@ -9,56 +10,80 @@ authors:
|
|
9
10
|
- Matthias Viehweger
|
10
11
|
- Kingsley Hendrickse
|
11
12
|
- Ohad Levy
|
13
|
+
- Dmitri Dolguikh
|
12
14
|
autorequire:
|
13
15
|
bindir: bin
|
14
16
|
cert_chain: []
|
15
|
-
date: 2012-
|
17
|
+
date: 2012-12-10 00:00:00.000000000 Z
|
16
18
|
dependencies:
|
19
|
+
- !ruby/object:Gem::Dependency
|
20
|
+
name: sexp_processor
|
21
|
+
requirement: !ruby/object:Gem::Requirement
|
22
|
+
none: false
|
23
|
+
requirements:
|
24
|
+
- - ! '>='
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: 4.1.2
|
27
|
+
type: :runtime
|
28
|
+
prerelease: false
|
29
|
+
version_requirements: !ruby/object:Gem::Requirement
|
30
|
+
none: false
|
31
|
+
requirements:
|
32
|
+
- - ! '>='
|
33
|
+
- !ruby/object:Gem::Version
|
34
|
+
version: 4.1.2
|
17
35
|
- !ruby/object:Gem::Dependency
|
18
36
|
name: ruby2ruby
|
19
37
|
requirement: !ruby/object:Gem::Requirement
|
38
|
+
none: false
|
20
39
|
requirements:
|
21
|
-
- - '>='
|
40
|
+
- - ! '>='
|
22
41
|
- !ruby/object:Gem::Version
|
23
|
-
version:
|
42
|
+
version: 2.0.1
|
24
43
|
type: :runtime
|
25
44
|
prerelease: false
|
26
45
|
version_requirements: !ruby/object:Gem::Requirement
|
46
|
+
none: false
|
27
47
|
requirements:
|
28
|
-
- - '>='
|
48
|
+
- - ! '>='
|
29
49
|
- !ruby/object:Gem::Version
|
30
|
-
version:
|
50
|
+
version: 2.0.1
|
31
51
|
- !ruby/object:Gem::Dependency
|
32
52
|
name: ruby_parser
|
33
53
|
requirement: !ruby/object:Gem::Requirement
|
54
|
+
none: false
|
34
55
|
requirements:
|
35
|
-
- - '>='
|
56
|
+
- - ! '>='
|
36
57
|
- !ruby/object:Gem::Version
|
37
|
-
version:
|
58
|
+
version: 3.0.1
|
38
59
|
type: :runtime
|
39
60
|
prerelease: false
|
40
61
|
version_requirements: !ruby/object:Gem::Requirement
|
62
|
+
none: false
|
41
63
|
requirements:
|
42
|
-
- - '>='
|
64
|
+
- - ! '>='
|
43
65
|
- !ruby/object:Gem::Version
|
44
|
-
version:
|
66
|
+
version: 3.0.1
|
45
67
|
- !ruby/object:Gem::Dependency
|
46
68
|
name: shoulda
|
47
69
|
requirement: !ruby/object:Gem::Requirement
|
70
|
+
none: false
|
48
71
|
requirements:
|
49
|
-
- - '>='
|
72
|
+
- - ! '>='
|
50
73
|
- !ruby/object:Gem::Version
|
51
74
|
version: '0'
|
52
75
|
type: :development
|
53
76
|
prerelease: false
|
54
77
|
version_requirements: !ruby/object:Gem::Requirement
|
78
|
+
none: false
|
55
79
|
requirements:
|
56
|
-
- - '>='
|
80
|
+
- - ! '>='
|
57
81
|
- !ruby/object:Gem::Version
|
58
82
|
version: '0'
|
59
83
|
- !ruby/object:Gem::Dependency
|
60
84
|
name: rdoc
|
61
85
|
requirement: !ruby/object:Gem::Requirement
|
86
|
+
none: false
|
62
87
|
requirements:
|
63
88
|
- - ~>
|
64
89
|
- !ruby/object:Gem::Version
|
@@ -66,6 +91,7 @@ dependencies:
|
|
66
91
|
type: :development
|
67
92
|
prerelease: false
|
68
93
|
version_requirements: !ruby/object:Gem::Requirement
|
94
|
+
none: false
|
69
95
|
requirements:
|
70
96
|
- - ~>
|
71
97
|
- !ruby/object:Gem::Version
|
@@ -73,20 +99,23 @@ dependencies:
|
|
73
99
|
- !ruby/object:Gem::Dependency
|
74
100
|
name: bundler
|
75
101
|
requirement: !ruby/object:Gem::Requirement
|
102
|
+
none: false
|
76
103
|
requirements:
|
77
104
|
- - ~>
|
78
105
|
- !ruby/object:Gem::Version
|
79
|
-
version: 1.0
|
106
|
+
version: '1.0'
|
80
107
|
type: :development
|
81
108
|
prerelease: false
|
82
109
|
version_requirements: !ruby/object:Gem::Requirement
|
110
|
+
none: false
|
83
111
|
requirements:
|
84
112
|
- - ~>
|
85
113
|
- !ruby/object:Gem::Version
|
86
|
-
version: 1.0
|
114
|
+
version: '1.0'
|
87
115
|
- !ruby/object:Gem::Dependency
|
88
116
|
name: jeweler
|
89
117
|
requirement: !ruby/object:Gem::Requirement
|
118
|
+
none: false
|
90
119
|
requirements:
|
91
120
|
- - ~>
|
92
121
|
- !ruby/object:Gem::Version
|
@@ -94,6 +123,7 @@ dependencies:
|
|
94
123
|
type: :development
|
95
124
|
prerelease: false
|
96
125
|
version_requirements: !ruby/object:Gem::Requirement
|
126
|
+
none: false
|
97
127
|
requirements:
|
98
128
|
- - ~>
|
99
129
|
- !ruby/object:Gem::Version
|
@@ -101,29 +131,65 @@ dependencies:
|
|
101
131
|
- !ruby/object:Gem::Dependency
|
102
132
|
name: rcov
|
103
133
|
requirement: !ruby/object:Gem::Requirement
|
134
|
+
none: false
|
135
|
+
requirements:
|
136
|
+
- - ! '>='
|
137
|
+
- !ruby/object:Gem::Version
|
138
|
+
version: '0'
|
139
|
+
type: :development
|
140
|
+
prerelease: false
|
141
|
+
version_requirements: !ruby/object:Gem::Requirement
|
142
|
+
none: false
|
143
|
+
requirements:
|
144
|
+
- - ! '>='
|
145
|
+
- !ruby/object:Gem::Version
|
146
|
+
version: '0'
|
147
|
+
- !ruby/object:Gem::Dependency
|
148
|
+
name: simplecov
|
149
|
+
requirement: !ruby/object:Gem::Requirement
|
150
|
+
none: false
|
151
|
+
requirements:
|
152
|
+
- - ! '>='
|
153
|
+
- !ruby/object:Gem::Version
|
154
|
+
version: '0'
|
155
|
+
type: :development
|
156
|
+
prerelease: false
|
157
|
+
version_requirements: !ruby/object:Gem::Requirement
|
158
|
+
none: false
|
159
|
+
requirements:
|
160
|
+
- - ! '>='
|
161
|
+
- !ruby/object:Gem::Version
|
162
|
+
version: '0'
|
163
|
+
- !ruby/object:Gem::Dependency
|
164
|
+
name: test-unit
|
165
|
+
requirement: !ruby/object:Gem::Requirement
|
166
|
+
none: false
|
104
167
|
requirements:
|
105
|
-
- - '>='
|
168
|
+
- - ! '>='
|
106
169
|
- !ruby/object:Gem::Version
|
107
170
|
version: '0'
|
108
171
|
type: :development
|
109
172
|
prerelease: false
|
110
173
|
version_requirements: !ruby/object:Gem::Requirement
|
174
|
+
none: false
|
111
175
|
requirements:
|
112
|
-
- - '>='
|
176
|
+
- - ! '>='
|
113
177
|
- !ruby/object:Gem::Version
|
114
178
|
version: '0'
|
115
179
|
- !ruby/object:Gem::Dependency
|
116
180
|
name: rake
|
117
181
|
requirement: !ruby/object:Gem::Requirement
|
182
|
+
none: false
|
118
183
|
requirements:
|
119
|
-
- - '>='
|
184
|
+
- - ! '>='
|
120
185
|
- !ruby/object:Gem::Version
|
121
186
|
version: '0'
|
122
187
|
type: :development
|
123
188
|
prerelease: false
|
124
189
|
version_requirements: !ruby/object:Gem::Requirement
|
190
|
+
none: false
|
125
191
|
requirements:
|
126
|
-
- - '>='
|
192
|
+
- - ! '>='
|
127
193
|
- !ruby/object:Gem::Version
|
128
194
|
version: '0'
|
129
195
|
description: A library for safe evaluation of Ruby code based on RubyParser and Ruby2Ruby.
|
@@ -166,24 +232,28 @@ files:
|
|
166
232
|
homepage: http://github.com/svenfuchs/safemode
|
167
233
|
licenses:
|
168
234
|
- MIT
|
169
|
-
metadata: {}
|
170
235
|
post_install_message:
|
171
236
|
rdoc_options: []
|
172
237
|
require_paths:
|
173
238
|
- lib
|
174
239
|
required_ruby_version: !ruby/object:Gem::Requirement
|
240
|
+
none: false
|
175
241
|
requirements:
|
176
|
-
- - '>='
|
242
|
+
- - ! '>='
|
177
243
|
- !ruby/object:Gem::Version
|
178
244
|
version: '0'
|
245
|
+
segments:
|
246
|
+
- 0
|
247
|
+
hash: -963555767727141691
|
179
248
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
249
|
+
none: false
|
180
250
|
requirements:
|
181
|
-
- - '>='
|
251
|
+
- - ! '>='
|
182
252
|
- !ruby/object:Gem::Version
|
183
253
|
version: '0'
|
184
254
|
requirements: []
|
185
255
|
rubyforge_project:
|
186
|
-
rubygems_version:
|
256
|
+
rubygems_version: 1.8.24
|
187
257
|
signing_key:
|
188
258
|
specification_version: 3
|
189
259
|
summary: A library for safe evaluation of Ruby code based on ParseTree/RubyParser
|
checksums.yaml
DELETED
@@ -1,7 +0,0 @@
|
|
1
|
-
---
|
2
|
-
SHA1:
|
3
|
-
metadata.gz: c245e2873cd76c69b67803ed92c9becc3fda6bed
|
4
|
-
data.tar.gz: 0a3131831248ebe163a82182194e3c4dd436d145
|
5
|
-
SHA512:
|
6
|
-
metadata.gz: 4d2efd9c8c6765a53bb2cc704279335605841f8070ddb58aacb015b61c989dd6c1e04f4cbb6434468fdf66f649a3643cc025aee7e172080329f316943c9742b0
|
7
|
-
data.tar.gz: 637be054f12f890b396ac757c6855b38dd8ef4a03a08d1d18830a39c6cde6435f5c30892109f45701b6d35af7858f8c0bf4d7d68932964cb9cbc14da481d52d9
|