therubyracer 0.12.0 → 0.12.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6488a4b018aa3bcbf2dd9ebdf8bb47a7cece0b5e
-  data.tar.gz: 9e16c6452241525ff12b8c1231421434cb0d2d06
+  metadata.gz: 9cfa70f9de350c1e76e6794ae66d1f7dd2026462
+  data.tar.gz: 21a5105a79939e804bfdf22d8a0e4108d614841c
 SHA512:
-  metadata.gz: fca9709c4f134600b6ba8e41370b799a258e7a5e61573eff5cef661a77ef87b4595e62ea60195331fbbdb59ad3b1d12d66a8b7d5bcb574208d385a3a33a3bec3
-  data.tar.gz: acdb5e300dac4818351afce6383da68ef4c73d5bc7de56b700df2752dc777e6dfe30adecb5ab12f4829aaf558f210b288cfadd4c8021670feb556672fd39c0ed
+  metadata.gz: cef15fc729596d2d9d0af7e5c5e467ff68e9db40faf66e200af4a7c555494d265a5415119243e440c955738b9bd22e50558fbf4eb69ea1df46ff1a597df267c3
+  data.tar.gz: 2bf28f39134268f84dc4bf029d0a9ef060670342c1fd7699e97c21debd4317c2ca14271a99b179a23e506955f557f0568c45d2880a058f891afb39f862549ca0

data/.travis.yml

@@ -1,11 +1,14 @@
+cache: bundler
 rvm:
+  - 2.1.0
   - 2.0.0
-  - 1.9.2
   - 1.9.3
+  - 1.9.2
   - 1.8.7
-  - rbx-18mode
-  - rbx-19mode
+  - rbx-2.2.3
 notifications:
   recipients:
     - cowboyd@thefrontside.net
+before_install:
+  - gem update --system 2.1.11
 script: bundle exec rake compile spec

data/Changelog.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.12.1 2014/02/03
+
+* add `timeout` option to `V8::Context` to forcibly abort long running scripts (thanks to @SamSaffron)
+* allow canonical require via  `require "therubyracer"` instead of oddball `require "v8"`(thanks @gaffneyc)
+
+## 0.12.0 2013/08/20
+
+* upgrade v8 to 3.16.4 (thanks to @ignisf)
+* enable native (and functional) weakref implementation for MRI > 2.0
+* expose low level interface for `V8::C::HeapStatistics#total_physical_size`
+
 ## 0.11.1 2013/01/04
 
 * reintroduce the dependency on libv8

data/Gemfile

@@ -2,8 +2,10 @@ source 'http://rubygems.org'
 
 gemspec
 
+gem "rubysl", :platforms => :rbx
 gem 'redjs', :git => 'https://github.com/cowboyd/redjs.git'
 gem "rake"
 gem "rspec", "~> 2.0"
 gem "rake-compiler"
-gem 'gem-compiler' unless Object.const_defined?(:RUBY_ENGINE) && RUBY_ENGINE == 'rbx'
+gem "gem-compiler", :platforms => :mri
+

data/README.md

@@ -1,9 +1,14 @@
 # therubyracer
 
-* [http://github.com/cowboyd/therubyracer](http://github.com/cowboyd/therubyracer)
-* [http://groups.google.com/group/therubyracer](http://groups.google.com/group/therubyracer)
-* [irc://irc.freenode.net/therubyracer](http://groups.google.com/group/therubyracer)
-* [Documentation](https://github.com/cowboyd/therubyracer/wiki)
+[![Gem Version](https://badge.fury.io/rb/therubyracer.png)](http://badge.fury.io/rb/therubyracer)
+[![Build Status](https://travis-ci.org/cowboyd/therubyracer.png?branch=master)](https://travis-ci.org/cowboyd/therubyracer)
+[![Dependency Status](https://gemnasium.com/cowboyd/therubyracer.png)](https://gemnasium.com/cowboyd/therubyracer)
+
+
+* GitHub Project: [http://github.com/cowboyd/therubyracer](http://github.com/cowboyd/therubyracer)
+* Mailing List: [http://groups.google.com/group/therubyracer](http://groups.google.com/group/therubyracer)
+* IRC / Chat: [irc://irc.freenode.net/therubyracer](http://groups.google.com/group/therubyracer)
+* Documentation: [GitHub Wiki](https://github.com/cowboyd/therubyracer/wiki) and [RubyDoc](http://rubydoc.info/gems/therubyracer)
 
 ### DESCRIPTION
 
@@ -24,13 +29,28 @@ then in your Ruby code
 
     require 'v8'
     # or if using bundler (as with Rails), add the following to your Gemfile
-    gem "therubyracer", :require => 'v8'
+    gem "therubyracer"
 
 evaluate some simple JavaScript
 
     cxt = V8::Context.new
     cxt.eval('7 * 6') #=> 42
 
+access values inside your JavaScript context from Ruby
+
+    cxt.eval 'var val = {num: 5, fun: function isTruthy(arg) { return !!arg }}'
+    val = cxt[:val] #=> V8::Object
+    cxt[:val] == cxt.scope.val #=> true
+    val.num #=> 5
+    val.isTruthy(1) #=> true
+
+this includes references to JavaScript functions
+
+    truthy = val[:isTruthy] #=> V8::Function
+    truthy.call(' ') #=> true
+    truthy.call(0) #=> false
+
+
 embed values into the scope of your context
 
     cxt['foo'] = "bar"
@@ -125,6 +145,32 @@ behavior you'd like.
 
 More documentation can be found on the [GitHub wiki](https://github.com/cowboyd/therubyracer/wiki)
 
+### Protecting Your CPU cycles
+
+When running untrusted JavaScript code, you not only have to protect
+which functions it has access to, but also how much of your CPU it can
+consume. Take this simple, yet thoroughly malicious script:
+
+```javascript
+while (true) {}
+```
+
+It will loop forever and never return control to the calling Ruby
+thread. To protect against such JavaScript code that either
+deliberately or accidentally runs longer that it should, you can
+set an explicit timeout on your context. If the code runs longer that
+the allowed timeout, then it will throw an exception. Note that this
+exception could be raised at any point in the execution of the
+JavaScript.
+
+To specify the timeout (in milliseconds), pass in the `timeout` option
+to the constructor.
+
+```ruby
+cxt = V8::Context.new timeout: 700
+cxt.eval "while (true);" #= exception after 700ms!
+```
+
 ### PREREQUISITES
 
 The Ruby Racer requires the V8 Javascript engine, but it offloads the
@@ -173,4 +219,4 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 [1]: https://github.com/cowboyd/libv8
-[2]: http://code.google.com/p/v8/wiki/BuildingWithGYP
+[2]: http://code.google.com/p/v8/wiki/BuildingWithGYP

data/ext/v8/rr.h

@@ -372,6 +372,7 @@ public:
   static void Init();
   static VALUE New(int argc, VALUE argv[], VALUE self);
   static VALUE Run(VALUE self);
+  static VALUE RunWithTimeout(VALUE self, VALUE timeout);
 
   inline Script(VALUE value) : Ref<v8::Script>(value) {}
   inline Script(v8::Handle<v8::Script> script) : Ref<v8::Script>(script) {}

data/ext/v8/script.cc

@@ -1,4 +1,6 @@
 #include "rr.h"
+#include "pthread.h"
+#include "unistd.h"
 
 namespace rr {
 
@@ -6,6 +8,7 @@ void Script::Init() {
   ClassBuilder("Script").
     defineSingletonMethod("New", &New).
     defineMethod("Run", &Run).
+    defineMethod("RunWithTimeout", &RunWithTimeout).
     store(&Class);
   ClassBuilder("ScriptOrigin").
     defineSingletonMethod("new", &ScriptOrigin::initialize).
@@ -69,6 +72,38 @@ VALUE Script::Run(VALUE self) {
   return Value(Script(self)->Run());
 }
 
+typedef struct {
+    v8::Isolate *isolate;
+    long timeout;
+} timeout_data;
+
+void* breaker(void *d) {
+  timeout_data* data = (timeout_data*)d;
+  usleep(data->timeout*1000);
+  pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
+  v8::V8::TerminateExecution(data->isolate);
+  return NULL;
+}
+
+VALUE Script::RunWithTimeout(VALUE self, VALUE timeout) {
+  pthread_t breaker_thread;
+  timeout_data data;
+  VALUE rval;
+  void *res;
+
+  data.isolate = v8::Isolate::GetCurrent();
+  data.timeout = NUM2LONG(timeout);
+
+  pthread_create(&breaker_thread, NULL, breaker, &data);
+
+  rval = Value(Script(self)->Run());
+
+  pthread_cancel(breaker_thread);
+  pthread_join(breaker_thread, &res);
+
+  return rval;
+}
+
 template <> void Pointer<v8::ScriptData>::unwrap(VALUE value) {
   Data_Get_Struct(value, class v8::ScriptData, pointer);
 }
@@ -77,4 +112,4 @@ template <> void Pointer<v8::ScriptOrigin>::unwrap(VALUE value) {
   Data_Get_Struct(value, class v8::ScriptOrigin, pointer);
 }
 
-} //namespace rr
+} //namespace rr

data/lib/therubyracer.rb

@@ -0,0 +1 @@
+require "v8"

data/lib/v8/context.rb

@@ -1,3 +1,4 @@
+# -*- coding: utf-8 -*-
 require 'stringio'
 module V8
   # All JavaScript must be executed in a context. This context consists of a global scope containing the
@@ -39,6 +40,10 @@ module V8
     #   @return [V8::C::Context] the underlying C++ object
     attr_reader :native
 
+    # @!attribute [r] timeout
+    #   @return [Number] maximum execution time in milliseconds for scripts executed in this context
+    attr_reader :timeout
+
     # Creates a new context.
     #
     # If passed the `:with` option, that object will be used as
@@ -50,12 +55,16 @@ module V8
     #       cxt['hello'] #=> 'Hi'
     #     end
     #
+    # If passed the `:timeout` option, every eval will timeout once
+    #   N milliseconds elapse
+    #
     # @param [Hash<Symbol, Object>] options initial context configuration
     #  * :with scope serves as the global scope of the new context
     # @yield [V8::Context] the newly created context
     def initialize(options = {})
       @conversion = Conversion.new
       @access = Access.new
+      @timeout = options[:timeout]
       if global = options[:with]
         Context.new.enter do
           global_template = global.class.to_template.InstanceTemplate()
@@ -84,7 +93,11 @@ module V8
       end
       enter do
         script = try { V8::C::Script::New(source.to_s, filename.to_s) }
-        to_ruby try {script.Run()}
+        if @timeout
+          to_ruby try {script.RunWithTimeout(@timeout)}
+        else
+          to_ruby try {script.Run()}
+        end
       end
     end
 
@@ -242,4 +255,4 @@ module V8
       Context.current = current
     end
   end
-end
+end

data/lib/v8/error.rb

@@ -139,11 +139,14 @@ module V8
   # @return [V8::Error] the error generated by this try/catch
   def self.Error(trycatch)
     exception = trycatch.Exception()
+
     value = exception.to_ruby
     cause = nil
-    javascript_backtrace = V8::StackTrace.new(trycatch.Message().GetStackTrace())
+    message = trycatch.Message()
+    javascript_backtrace = V8::StackTrace.new(message.GetStackTrace()) if message
+
     message = if !exception.kind_of?(V8::C::Value)
-      exception.to_s
+      exception.to_s==""?"Script Timed Out":exception.to_s
     elsif exception.IsNativeError()
       if cause = exception.GetHiddenValue("rr::Cause")
         cause = cause.Value()
@@ -163,4 +166,4 @@ module V8
     V8::Error.new(message, value, javascript_backtrace, cause)
   end
   const_set :JSError, Error
-end
+end

data/lib/v8/version.rb

@@ -1,3 +1,3 @@
 module V8
-  VERSION = "0.12.0"
+  VERSION = "0.12.1"
 end

data/spec/threading_spec.rb

@@ -1,5 +1,17 @@
 require 'spec_helper'
 
+describe "Timeouts" do
+  it "allows for timeout on context" do
+    ctx = V8::Context.new(:timeout => 10)
+    lambda {ctx.eval("while(true){}")}.should(raise_error)
+
+    # context should not be bust after it exploded once
+    ctx["x"] = 1;
+    ctx.eval("x=2;")
+    ctx["x"].should == 2
+  end
+end
+
 describe "using v8 from multiple threads", :threads => true do
 
   it "creates contexts from within threads" do
@@ -49,4 +61,4 @@ describe "using v8 from multiple threads", :threads => true do
       V8::C::Locker::StopPreemption()
     end
   end
-end
+end

data/spec/v8/error_spec.rb

@@ -64,11 +64,12 @@ describe V8::Error do
   describe "backtrace" do
     it "is mixed with ruby and javascript" do
       throw! do |e|
-        e.backtrace.first.should == "at three.js:1:7"
-        e.backtrace[1].should =~ /error_spec.rb/
-        e.backtrace[2].should == "at two.js:1:1"
-        e.backtrace[3].should =~ /error_spec.rb/
-        e.backtrace[4].should == "at one.js:1:1"
+        backtrace = e.backtrace.reject { |l| /kernel\// =~ l }
+        backtrace.first.should eql  "at three.js:1:7"
+        backtrace[1].should  match(/error_spec.rb/)
+        backtrace[2].should eql "at two.js:1:1"
+        backtrace[3].should match(/error_spec.rb/)
+        backtrace[4].should eql "at one.js:1:1"
       end
     end
 
@@ -114,8 +115,9 @@ INVALID
       lambda {
         @cxt.eval('boom()', "boom.js")
       }.should(raise_error {|e|
-        e.backtrace.first.should =~ /error_spec\.rb/
-        e.backtrace[1].should =~ /boom.js/
+        backtrace = e.backtrace.reject { |l| /kernel\// =~ l }
+        backtrace.first.should =~ /error_spec\.rb/
+        backtrace[1].should =~ /boom.js/
       })
     end
   end

data/therubyracer.gemspec

@@ -15,6 +15,7 @@ Gem::Specification.new do |gem|
   gem.extensions    = ["ext/v8/extconf.rb"]
   gem.require_paths = ["lib", "ext"]
   gem.version       = V8::VERSION
+  gem.license       = 'MIT'
 
   gem.add_dependency 'ref'
   gem.add_dependency 'libv8', '~> 3.16.14.0'

metadata

@@ -1,35 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: therubyracer
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.12.1
 platform: ruby
 authors:
 - Charles Lowell
 autorequire: 
 bindir: bin
-cert_chain:
-- |
-  -----BEGIN CERTIFICATE-----
-  MIIDPjCCAiagAwIBAgIBADANBgkqhkiG9w0BAQUFADBFMRAwDgYDVQQDDAdjb3di
-  b3lkMRwwGgYKCZImiZPyLGQBGRYMdGhlZnJvbnRzaWRlMRMwEQYKCZImiZPyLGQB
-  GRYDbmV0MB4XDTEzMDEzMDIxMDYwNFoXDTE0MDEzMDIxMDYwNFowRTEQMA4GA1UE
-  AwwHY293Ym95ZDEcMBoGCgmSJomT8ixkARkWDHRoZWZyb250c2lkZTETMBEGCgmS
-  JomT8ixkARkWA25ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAO45
-  CUxpETDGYXjCCy2dMg/aIrdrTqBqQW5ZrzhHxF9EkcdmWFr0z/qMz0JSpZ3pF11Z
-  KYaj5PaQQpjZfLPwbuiGGkuSWi+UAac//V18xo6S4lzRBjO+gpzG9f2AOzt9b+SR
-  Uc8UhO7QBZ5edUDxMxw9QstD+U0YBAlzsPJbHuUOqdtxXmNQCds3ZnqTgZaIpdUy
-  CSejtrukSmlthxFzwgMezYQhcYxmkl+Q475JUodnI6Pjc6nja/Or8Y6cEWiLgeUa
-  a+efcPGLDEbwJC7TGRrvk8yassMByBEJ3XueTMzeqWFd+665ptciojYo6BvIAR0N
-  iLwks0x567FZyS8SqTcCAwEAAaM5MDcwCQYDVR0TBAIwADAdBgNVHQ4EFgQUxVgR
-  5TUqf7Hd24ICb3g4FNbM7oYwCwYDVR0PBAQDAgSwMA0GCSqGSIb3DQEBBQUAA4IB
-  AQDdJj+NzZhiYXA56z0wzRUA/Fcf6CYqKB+RFRlPssDEcHTor5SnwdWgQof/gNLi
-  Qel1Om4zO0Shcp89jxaUqtvEdYVhmyfc0vycHmemKttNBT734yMrEJtF8Hhy+Dnz
-  9CzixXLvgGaRH+mf3M0+l+zIDJJr2L+39L8cyTSSRnp/srfI8aSmJKhGshudBKoC
-  Ty6Gi071pwoJXvdMaE/6iPy7bUzlndYdHyYuWSKaO9N47HqQ62oEnBraglw6ghoi
-  UgImJlChAzCoDP9zi9tdm6jAr7ttF25R9PPYr11ILb7dYe3qUzlNlM6zJx/nb31b
-  IhdyRVup4qLcqYSTPsm6u7VA
-  -----END CERTIFICATE-----
-date: 2013-08-20 00:00:00.000000000 Z
+cert_chain: []
+date: 2014-02-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ref
@@ -105,6 +84,7 @@ files:
 - ext/v8/trycatch.cc
 - ext/v8/v8.cc
 - ext/v8/value.cc
+- lib/therubyracer.rb
 - lib/v8.rb
 - lib/v8/access.rb
 - lib/v8/access/indices.rb
@@ -158,7 +138,8 @@ files:
 - thefrontside.png
 - therubyracer.gemspec
 homepage: http://github.com/cowboyd/therubyracer
-licenses: []
+licenses:
+- MIT
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -177,7 +158,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0
+rubygems_version: 2.0.3
 signing_key: 
 specification_version: 4
 summary: Embed the V8 JavaScript interpreter into Ruby