secure 0.1.1 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/Rakefile +4 -5
- data/lib/secure.rb +5 -2
- data/lib/secure/runner.rb +3 -2
- data/lib/secure/version.rb +1 -1
- data/secure.gemspec +3 -0
- data/spec/secure/runner_spec.rb +107 -0
- data/spec/secure_spec.rb +5 -99
- metadata +36 -7
data/Rakefile
CHANGED
@@ -1,12 +1,11 @@
|
|
1
1
|
require 'bundler/gem_tasks'
|
2
2
|
require 'rake'
|
3
|
-
require '
|
3
|
+
require 'rspec/core/rake_task'
|
4
4
|
|
5
5
|
desc "Run all examples"
|
6
|
-
|
7
|
-
t.
|
8
|
-
t.
|
9
|
-
t.spec_files = FileList['spec/**/*.rb']
|
6
|
+
RSpec::Core::RakeTask.new('spec') do |t|
|
7
|
+
t.rspec_opts = "--colour --format documentation -r spec/spec_helper"
|
8
|
+
t.pattern = 'spec/**/*.rb'
|
10
9
|
end
|
11
10
|
|
12
11
|
task :default => :spec
|
data/lib/secure.rb
CHANGED
@@ -9,9 +9,12 @@ require "secure/runner"
|
|
9
9
|
module Secure
|
10
10
|
class << self
|
11
11
|
def run(opts = {}, *args)
|
12
|
-
Runner.new(opts).run do
|
13
|
-
yield *
|
12
|
+
response = Runner.new(opts, *args).run do |*a|
|
13
|
+
yield *a
|
14
14
|
end
|
15
|
+
|
16
|
+
raise response.error unless response.success?
|
17
|
+
response.value
|
15
18
|
end
|
16
19
|
|
17
20
|
alias :ly :run
|
data/lib/secure/runner.rb
CHANGED
@@ -1,7 +1,8 @@
|
|
1
1
|
module Secure
|
2
2
|
class Runner
|
3
|
-
def initialize(opts)
|
3
|
+
def initialize(opts = {}, *args)
|
4
4
|
@opts = opts
|
5
|
+
@args = args
|
5
6
|
end
|
6
7
|
|
7
8
|
def run
|
@@ -9,7 +10,7 @@ module Secure
|
|
9
10
|
|
10
11
|
child = fork do
|
11
12
|
begin
|
12
|
-
ChildProcess.new(@opts, read_file, write_file).execute { yield }
|
13
|
+
ChildProcess.new(@opts, read_file, write_file).execute { yield *@args }
|
13
14
|
ensure
|
14
15
|
exit
|
15
16
|
end
|
data/lib/secure/version.rb
CHANGED
data/secure.gemspec
CHANGED
@@ -17,4 +17,7 @@ Gem::Specification.new do |s|
|
|
17
17
|
s.test_files = `git ls-files -- {test,spec,features}/*`.split("\n")
|
18
18
|
s.executables = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
|
19
19
|
s.require_paths = ["lib"]
|
20
|
+
|
21
|
+
s.add_development_dependency('rspec')
|
22
|
+
s.add_development_dependency('rake')
|
20
23
|
end
|
@@ -0,0 +1,107 @@
|
|
1
|
+
module Secure
|
2
|
+
describe Runner do
|
3
|
+
it "should execute normal code as expected" do
|
4
|
+
response = Runner.new.run do
|
5
|
+
4 + 4
|
6
|
+
end
|
7
|
+
response.should be_success
|
8
|
+
response.value.should == 8
|
9
|
+
end
|
10
|
+
|
11
|
+
it "should kill all threads after running" do
|
12
|
+
response = Runner.new.run do
|
13
|
+
10
|
14
|
+
end
|
15
|
+
response.should be_success
|
16
|
+
Thread.list.should have(1).things
|
17
|
+
end
|
18
|
+
|
19
|
+
it "should take parameters" do
|
20
|
+
response = Runner.new({}, 4, 2).run do |a, b|
|
21
|
+
a + b
|
22
|
+
end
|
23
|
+
response.should be_success
|
24
|
+
response.value.should == 6
|
25
|
+
end
|
26
|
+
|
27
|
+
context "safe value" do
|
28
|
+
it "should be set to 3" do
|
29
|
+
response = Runner.new.run do
|
30
|
+
$SAFE
|
31
|
+
end
|
32
|
+
response.should be_success
|
33
|
+
response.value.should == 3
|
34
|
+
end
|
35
|
+
|
36
|
+
it "should not be affected in the parent thread" do
|
37
|
+
response = Runner.new.run {}
|
38
|
+
response.should be_success
|
39
|
+
$SAFE.should == 0
|
40
|
+
end
|
41
|
+
end
|
42
|
+
|
43
|
+
context "security violations" do
|
44
|
+
it "should not allow an eval to be called" do
|
45
|
+
response = Runner.new.run do
|
46
|
+
eval "45"
|
47
|
+
end
|
48
|
+
response.should_not be_success
|
49
|
+
response.error.should be_a(SecurityError)
|
50
|
+
end
|
51
|
+
|
52
|
+
it "should not allow system calls" do
|
53
|
+
response = Runner.new.run do
|
54
|
+
system("echo hi")
|
55
|
+
end
|
56
|
+
response.should_not be_success
|
57
|
+
response.error.should be_a(SecurityError)
|
58
|
+
end
|
59
|
+
|
60
|
+
it "should kill infinite loops" do
|
61
|
+
response = Runner.new(:timeout => 0.005).run do
|
62
|
+
while true; end
|
63
|
+
end
|
64
|
+
response.should_not be_success
|
65
|
+
response.error.should be_a(Secure::TimeoutError)
|
66
|
+
end
|
67
|
+
|
68
|
+
it "should not be able to open a file" do
|
69
|
+
response = Runner.new.run do
|
70
|
+
File.open("/etc/passwd")
|
71
|
+
end
|
72
|
+
response.should_not be_success
|
73
|
+
response.error.should be_a(SecurityError)
|
74
|
+
end
|
75
|
+
end
|
76
|
+
|
77
|
+
context "allowed syntax" do
|
78
|
+
it "should allow eval on an untainted string" do
|
79
|
+
string = "45".untaint
|
80
|
+
response = Runner.new({}, string).run do |str|
|
81
|
+
eval(str)
|
82
|
+
end
|
83
|
+
response.should be_success
|
84
|
+
response.value.should == 45
|
85
|
+
end
|
86
|
+
|
87
|
+
it "should be able to read from an open file" do
|
88
|
+
file = File.open("/etc/hosts")
|
89
|
+
response = Runner.new({}, file).run do |file|
|
90
|
+
file.readline
|
91
|
+
end
|
92
|
+
response.should be_success
|
93
|
+
end
|
94
|
+
end
|
95
|
+
|
96
|
+
context "error information" do
|
97
|
+
it "should know where the syntax is invalid" do
|
98
|
+
string = "while true; end; end"
|
99
|
+
response = Runner.new({}, string).run do |string|
|
100
|
+
eval(string)
|
101
|
+
end
|
102
|
+
response.should_not be_success
|
103
|
+
response.error.should be_a(SyntaxError)
|
104
|
+
end
|
105
|
+
end
|
106
|
+
end
|
107
|
+
end
|
data/spec/secure_spec.rb
CHANGED
@@ -1,105 +1,11 @@
|
|
1
1
|
describe Secure do
|
2
|
-
it "should execute
|
3
|
-
|
4
|
-
4 + 4
|
5
|
-
end
|
6
|
-
response.should be_success
|
7
|
-
response.value.should == 8
|
8
|
-
end
|
9
|
-
|
10
|
-
it "should kill all threads after running" do
|
11
|
-
response = Secure.ly do
|
12
|
-
10
|
13
|
-
end
|
14
|
-
response.should be_success
|
15
|
-
Thread.list.should have(1).things
|
16
|
-
end
|
17
|
-
|
18
|
-
it "should take parameters" do
|
19
|
-
response = Secure.ly({}, 4, 2) do |a, b|
|
2
|
+
it "should execute a block with params" do
|
3
|
+
Secure.ly({}, 4, 2) do |a, b|
|
20
4
|
a + b
|
21
|
-
end
|
22
|
-
response.should be_success
|
23
|
-
response.value.should == 6
|
24
|
-
end
|
25
|
-
|
26
|
-
context "safe value" do
|
27
|
-
it "should be set to 3" do
|
28
|
-
response = Secure.ly do
|
29
|
-
$SAFE
|
30
|
-
end
|
31
|
-
response.should be_success
|
32
|
-
response.value.should == 3
|
33
|
-
end
|
34
|
-
|
35
|
-
it "should not be affected in the parent thread" do
|
36
|
-
response = Secure.ly {}
|
37
|
-
response.should be_success
|
38
|
-
$SAFE.should == 0
|
39
|
-
end
|
40
|
-
end
|
41
|
-
|
42
|
-
context "security violations" do
|
43
|
-
it "should not allow an eval to be called" do
|
44
|
-
response = Secure.ly do
|
45
|
-
eval "45"
|
46
|
-
end
|
47
|
-
response.should_not be_success
|
48
|
-
response.error.should be_a(SecurityError)
|
49
|
-
end
|
50
|
-
|
51
|
-
it "should not allow system calls" do
|
52
|
-
response = Secure.ly do
|
53
|
-
system("echo hi")
|
54
|
-
end
|
55
|
-
response.should_not be_success
|
56
|
-
response.error.should be_a(SecurityError)
|
57
|
-
end
|
58
|
-
|
59
|
-
it "should kill infinite loops" do
|
60
|
-
response = Secure.ly :timeout => 0.005 do
|
61
|
-
while true; end
|
62
|
-
end
|
63
|
-
response.should_not be_success
|
64
|
-
response.error.should be_a(Secure::TimeoutError)
|
65
|
-
end
|
66
|
-
|
67
|
-
it "should not be able to open a file" do
|
68
|
-
response = Secure.ly do
|
69
|
-
File.open("/etc/passwd")
|
70
|
-
end
|
71
|
-
response.should_not be_success
|
72
|
-
response.error.should be_a(SecurityError)
|
73
|
-
end
|
74
|
-
end
|
75
|
-
|
76
|
-
context "allowed syntax" do
|
77
|
-
it "should allow eval on an untainted string" do
|
78
|
-
string = "45".untaint
|
79
|
-
response = Secure.ly({}, string) do |str|
|
80
|
-
eval(str)
|
81
|
-
end
|
82
|
-
response.should be_success
|
83
|
-
response.value.should == 45
|
84
|
-
end
|
85
|
-
|
86
|
-
it "should be able to read from an open file" do
|
87
|
-
file = File.open("/etc/hosts")
|
88
|
-
response = Secure.ly({}, file) do |file|
|
89
|
-
file.readline
|
90
|
-
end
|
91
|
-
response.should be_success
|
92
|
-
end
|
5
|
+
end.should eq(6)
|
93
6
|
end
|
94
7
|
|
95
|
-
|
96
|
-
|
97
|
-
string = "while true; end; end"
|
98
|
-
response = Secure.ly({}, string) do |string|
|
99
|
-
eval(string)
|
100
|
-
end
|
101
|
-
response.should_not be_success
|
102
|
-
response.error.should be_a(SyntaxError)
|
103
|
-
end
|
8
|
+
it "should throw an exception if block fails" do
|
9
|
+
lambda { Secure.ly(:timeout => 0.1) { while true; end } }.should raise_error(Secure::TimeoutError)
|
104
10
|
end
|
105
11
|
end
|
metadata
CHANGED
@@ -1,13 +1,13 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: secure
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
hash:
|
4
|
+
hash: 23
|
5
5
|
prerelease:
|
6
6
|
segments:
|
7
7
|
- 0
|
8
|
-
-
|
9
|
-
-
|
10
|
-
version: 0.
|
8
|
+
- 2
|
9
|
+
- 0
|
10
|
+
version: 0.2.0
|
11
11
|
platform: ruby
|
12
12
|
authors:
|
13
13
|
- Tejas Dinkar
|
@@ -15,10 +15,37 @@ autorequire:
|
|
15
15
|
bindir: bin
|
16
16
|
cert_chain: []
|
17
17
|
|
18
|
-
date: 2011-
|
18
|
+
date: 2011-09-02 00:00:00 +05:30
|
19
19
|
default_executable:
|
20
|
-
dependencies:
|
21
|
-
|
20
|
+
dependencies:
|
21
|
+
- !ruby/object:Gem::Dependency
|
22
|
+
name: rspec
|
23
|
+
prerelease: false
|
24
|
+
requirement: &id001 !ruby/object:Gem::Requirement
|
25
|
+
none: false
|
26
|
+
requirements:
|
27
|
+
- - ">="
|
28
|
+
- !ruby/object:Gem::Version
|
29
|
+
hash: 3
|
30
|
+
segments:
|
31
|
+
- 0
|
32
|
+
version: "0"
|
33
|
+
type: :development
|
34
|
+
version_requirements: *id001
|
35
|
+
- !ruby/object:Gem::Dependency
|
36
|
+
name: rake
|
37
|
+
prerelease: false
|
38
|
+
requirement: &id002 !ruby/object:Gem::Requirement
|
39
|
+
none: false
|
40
|
+
requirements:
|
41
|
+
- - ">="
|
42
|
+
- !ruby/object:Gem::Version
|
43
|
+
hash: 3
|
44
|
+
segments:
|
45
|
+
- 0
|
46
|
+
version: "0"
|
47
|
+
type: :development
|
48
|
+
version_requirements: *id002
|
22
49
|
description: see summary
|
23
50
|
email:
|
24
51
|
- tejas@gja.in
|
@@ -42,6 +69,7 @@ files:
|
|
42
69
|
- lib/secure/version.rb
|
43
70
|
- secure.gemspec
|
44
71
|
- spec/secure/response_spec.rb
|
72
|
+
- spec/secure/runner_spec.rb
|
45
73
|
- spec/secure_spec.rb
|
46
74
|
- spec/spec_helper.rb
|
47
75
|
has_rdoc: true
|
@@ -80,5 +108,6 @@ specification_version: 3
|
|
80
108
|
summary: gem to do things securely using ruby $SAFE
|
81
109
|
test_files:
|
82
110
|
- spec/secure/response_spec.rb
|
111
|
+
- spec/secure/runner_spec.rb
|
83
112
|
- spec/secure_spec.rb
|
84
113
|
- spec/spec_helper.rb
|