safemode 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 795ca593ca92570d9d4a54cbad72c18c32574d1190b37d002acb22f0347814e0
-  data.tar.gz: 585a9de965e98cc5f7d847357db1db8ce2a52e1200cf17169dc109c4cda231b5
+  metadata.gz: 60d02e15fb3d2ae2d1447e72e0c92e7379c826393b64349ce3c2c71ca4d53da5
+  data.tar.gz: 3cb324e0289157a132e5edd0535cc66d6ae351acf737b092d74a68859ebfe887
 SHA512:
-  metadata.gz: d27b2e9fa7e9893cc43039c37c884e21c1e7945974d3614a907818453e99b88d0cd37ab68d43058e01303f3d6bc6966f51edeee009a712994ad40b754660a4d7
-  data.tar.gz: 1b6ddc2ab11f82cc6275d9ea26aa57800ebcfc2a2e7a84612894bb61b17a879e1b83eac20dff722091fab596eeb04912110d4bb70dbcce924771b189c218894f
+  metadata.gz: 364354811cc8928d257da2d095e4aed8301eb5d26a7d2303d8f0be5e9d16a1c9172f04c967c385a31ea24af95dc6c2eb00ef2fd7eb47426872db0064a5035cd0
+  data.tar.gz: 01f78d9d81dffa08d50068177840324c7d54db94249a3714b34d2e2301386836a061c85da2ce4d610c8890f60427b76bb2fa3bb2f7e90a917a6c2316ff58c13b

data/demo.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'safemode'
 require 'erb'
 

data/lib/safemode/core_jails.rb

@@ -17,15 +17,11 @@ module Safemode
     end
 
     def core_classes
-      klasses = [ Array, Float, Hash, Range, String, Symbol, Time, NilClass, FalseClass, TrueClass ]
+      klasses = [ Array, Float, Hash, Integer, Range, String, Symbol, Time, NilClass, FalseClass, TrueClass ]
       klasses << Date if defined? Date
       klasses << DateTime if defined? DateTime
-      if RUBY_VERSION >= '2.4.0'
-        klasses << Integer
-      else
-        klasses << Bignum
-        klasses << Fixnum
-      end
+      klasses << Data if defined? Data # Ruby 3.2 addition
+      klasses << Set if defined? Set # Ruby 3.2 addition
       klasses
     end
 
@@ -46,31 +42,21 @@ module Safemode
   # whitelisted methods for core classes ... kind of arbitrary selection
   @@methods_whitelist = {
     'Array'      => %w(any? assoc at blank? collect collect! compact compact!
-                    concat delete delete_at delete_if each each_index empty?
-                    fetch fill first flatten flatten! hash include? index
+                    concat delete delete_at delete_if each each_index each_with_index
+                    empty? fetch fill first flatten flatten! hash include? index
                     indexes indices inject insert join last length map map! max min
                     nitems pop push present? rassoc reject reject! reverse
                     reverse! reverse_each rindex select shift size slice
                     slice! sort sort! transpose to_sentence uniq uniq! unshift
                     values_at zip),
 
-    'Bignum'     => %w(abs blank? ceil chr coerce div divmod downto floor hash
-                    integer? modulo next nonzero? present? quo remainder round
-                    singleton_method_added size step succ times to_f to_i
-                    to_int to_s truncate upto zero?),
-
-    'Fixnum'     => %w(abs blank? ceil chr coerce div divmod downto floor id2name
-                    integer? modulo modulo next nonzero? present? quo remainder
-                    round singleton_method_added size step succ times to_f to_i
-                    to_int to_s to_sym truncate upto zero?),
-
     'Float'      => %w(abs blank? ceil coerce div divmod finite? floor hash
                     infinite? integer? modulo nan? nonzero? present? quo
                     remainder round singleton_method_added step to_f to_i
                     to_int to_s truncate zero?),
 
-    'Hash'       => %w(any? blank? clear delete delete_if each each_key
-                    each_pair each_value empty? fetch dig has_key? has_value?
+    'Hash'       => %w(any? blank? clear delete delete_if each each_key each_pair
+                    each_value each_with_index empty? fetch dig has_key? has_value?
                     include? index invert key? keys length member? merge merge!
                     present? rec_merge! rehash reject reject! select shift
                     size sort store update value? values values_at),
@@ -116,6 +102,17 @@ module Safemode
     'DateTime'   => %w(blank? hour min new_offset newof of offset present? sec
                     sec_fraction strftime to_datetime_default_s to_json zone),
 
+    'Data'       => %w(deconstruct deconstruct_keys hash members),
+
+    'Set'        => %w(any? blank? clear clone collect count delete delete?
+                    delete_if difference disjoint? each each_with_index
+                    each_with_object empty? filter find first flatten
+                    flatten! hash include? inject intersect? intersection
+                    join keep_if length map max member? merge min
+                    present? reject reject! replace select select!
+                    size sort sort_by subset? superset? union
+                    uniq zip),
+
     'NilClass'   => %w(blank? duplicable? present? to_f to_i),
 
     'FalseClass' => %w(blank? duplicable? present?),

data/lib/safemode/parser.rb

@@ -1,6 +1,5 @@
 module Safemode
   class Parser < Ruby2Ruby
-    # @@parser = defined?(RubyParser) ? 'RubyParser' : 'ParseTree'
     @@parser = 'RubyParser'
 
     class << self
@@ -12,8 +11,6 @@ module Safemode
 
       def parse(code)
         case @@parser
-        # when 'ParseTree'
-        #   ParseTree.translate(code)
         when 'RubyParser'
           RubyParser.new.parse(code)
         else
@@ -90,7 +87,8 @@ module Safemode
                    :colon2,
                    # unnecessarily advanced?
                    :argscat, :argspush, :splat,
-                   :op_asgn1, :op_asgn2, :op_asgn_and, :op_asgn_or,
+                   :op_asgn, :op_asgn1, :op_asgn2, :op_asgn_and, :op_asgn_or,
+                   :safe_op_asgn,
                    # needed for haml
                    :block ]
 

data/lib/safemode.rb

@@ -5,13 +5,6 @@ begin
   require 'ruby_parser' # try to load RubyParser and use it if present
 rescue LoadError => e
 end
-# this doesn't work somehow. Maybe something changed inside
-# ParseTree or sexp_processor or so.
-# (the require itself works, but ParseTree doesn't play nice)
-# begin
-#   require 'parse_tree'
-# rescue LoadError => e
-# end
 
 require 'safemode/core_ext'
 require 'safemode/blankslate'

data/safemode.gemspec

@@ -4,10 +4,10 @@ require 'date'
 
 Gem::Specification.new do |s|
   s.name = "safemode".freeze
-  s.version = "1.5.0"
+  s.version = "1.6.0"
   s.date = Date.today
 
-  s.summary = "A library for safe evaluation of Ruby code based on ParseTree/RubyParser and Ruby2Ruby"
+  s.summary = "A library for safe evaluation of Ruby code based on RubyParser and Ruby2Ruby"
   s.description = "A library for safe evaluation of Ruby code based on RubyParser and Ruby2Ruby. Provides Rails ActionView template handlers for ERB and Haml."
   s.homepage = "https://github.com/svenfuchs/safemode"
   s.licenses = ["MIT"]
@@ -54,12 +54,12 @@ Gem::Specification.new do |s|
 
   s.required_ruby_version = ">= 2.7", "< 3.2"
 
-  s.add_runtime_dependency "ruby2ruby", ">= 2.4.0"
-  s.add_runtime_dependency "ruby_parser", ">= 3.10.1"
-  s.add_runtime_dependency "sexp_processor", ">= 4.10.0"
+  s.add_runtime_dependency "ruby2ruby", "~> 2.4"
+  s.add_runtime_dependency "ruby_parser", "~> 3.10"
+  s.add_runtime_dependency "sexp_processor", "~> 4.10"
 
-  s.add_development_dependency "rake"
-  s.add_development_dependency "rdoc"
-  s.add_development_dependency "simplecov"
-  s.add_development_dependency "test-unit"
+  s.add_development_dependency "rake", "~> 13.4"
+  s.add_development_dependency "rdoc", "~> 7.2"
+  s.add_development_dependency "simplecov", "~> 0.22"
+  s.add_development_dependency "test-unit", "~> 3.7"
 end

data/test/test_erb_eval.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require File.join(File.dirname(__FILE__), 'test_helper')
 
 class TestERBEval < Test::Unit::TestCase
@@ -58,19 +60,17 @@ class TestERBEval < Test::Unit::TestCase
   end
 
   TestHelper.no_method_error_raising_calls.each do |call|
-    call.gsub!('"', '\\\\"')
     class_eval %Q(
       def test_calling_#{call.gsub(/[\W]/, '_')}_should_raise_no_method
-        assert_raise_no_method "#{call}", @assigns, @locals
+        assert_raise_no_method "#{call.gsub('"', '\\\\"')}", @assigns, @locals
       end
     )
   end
 
   TestHelper.security_error_raising_calls.each do |call|
-    call.gsub!('"', '\\\\"')
     class_eval %Q(
       def test_calling_#{call.gsub(/[\W]/, '_')}_should_raise_security
-        assert_raise_security "#{call}", @assigns, @locals
+        assert_raise_security "#{call.gsub('"', '\\\\"')}", @assigns, @locals
       end
     )
   end

data/test/test_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 if ENV['COVERAGE']
   require 'simplecov'
   SimpleCov.start {add_filter 'test_'}

data/test/test_jail.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require File.join(File.dirname(__FILE__), 'test_helper')
 
 class TestJail < Test::Unit::TestCase

data/test/test_safemode_eval.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require File.join(File.dirname(__FILE__), 'test_helper')
 
 class TestSafemodeEval < Test::Unit::TestCase
@@ -98,20 +100,40 @@ class TestSafemodeEval < Test::Unit::TestCase
     end
   end
 
+  if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.2')
+    def test_pattern_matching_with_data_subclass
+      point_class = Data.define(:x, :y)
+      point = point_class.new(x: 10, y: 20)
+      assert_equal 10, @box.eval('case @point; in {x:}; x; end', { point: point })
+    end
+
+    def test_data_subclass_inherits_data_jail
+      point_class = Data.define(:x, :y)
+      point = point_class.new(x: 10, y: 20)
+      assert_equal [:x, :y], @box.eval('@point.members', { point: point })
+      assert_equal [10, 20], @box.eval('@point.deconstruct', { point: point })
+      assert_equal({ x: 10 }, @box.eval('@point.deconstruct_keys([:x])', { point: point }))
+    end
+
+    def test_data_subclass_jail_blocks_non_whitelisted_methods
+      point_class = Data.define(:x, :y)
+      point = point_class.new(x: 10, y: 20)
+      assert_raise(Safemode::NoMethodError) { @box.eval('@point.instance_variables', { point: point }) }
+    end
+  end
+
   TestHelper.no_method_error_raising_calls.each do |call|
-    call.gsub!('"', '\\\\"')
     class_eval %Q(
       def test_calling_#{call.gsub(/[\W]/, '_')}_should_raise_no_method
-        assert_raise_no_method "#{call}", @assigns, @locals
+        assert_raise_no_method "#{call.gsub('"', '\\\\"')}", @assigns, @locals
       end
     )
   end
 
   TestHelper.security_error_raising_calls.each do |call|
-    call.gsub!('"', '\\\\"')
     class_eval %Q(
       def test_calling_#{call.gsub(/[\W]/, '_')}_should_raise_security
-        assert_raise_security "#{call}", @assigns, @locals
+        assert_raise_security "#{call.gsub('"', '\\\\"')}", @assigns, @locals
       end
     )
   end

data/test/test_safemode_parser.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require File.join(File.dirname(__FILE__), 'test_helper')
 
 class TestSafemodeParser < Test::Unit::TestCase

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safemode
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Sven Fuchs
@@ -13,106 +13,106 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-03-19 00:00:00.000000000 Z
+date: 2026-05-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ruby2ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.4.0
+        version: '2.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.4.0
+        version: '2.4'
 - !ruby/object:Gem::Dependency
   name: ruby_parser
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.1
+        version: '3.10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.10.1
+        version: '3.10'
 - !ruby/object:Gem::Dependency
   name: sexp_processor
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.10.0
+        version: '4.10'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.10.0
+        version: '4.10'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '13.4'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '13.4'
 - !ruby/object:Gem::Dependency
   name: rdoc
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '7.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '7.2'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.22'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.22'
 - !ruby/object:Gem::Dependency
   name: test-unit
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3.7'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3.7'
 description: A library for safe evaluation of Ruby code based on RubyParser and Ruby2Ruby.
   Provides Rails ActionView template handlers for ERB and Haml.
 email:
@@ -168,9 +168,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.10
+rubygems_version: 3.2.33
 signing_key:
 specification_version: 4
-summary: A library for safe evaluation of Ruby code based on ParseTree/RubyParser
-  and Ruby2Ruby
+summary: A library for safe evaluation of Ruby code based on RubyParser and Ruby2Ruby
 test_files: []