From 60ea0155bb3b71c82142da4e2ae89f824f859334 Mon Sep 17 00:00:00 2001
From: mame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 4 Aug 2009 16:44:05 +0000
Subject: * lib/pp.rb (guard_inspect_key): untrust internal hash to prevent  
 unexpected SecurityError.

* test/ruby/test_object.rb: add a test for [ruby-dev:38982].

git-svn-id: http://svn.ruby-lang.org/repos/ruby/trunk@24396 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog                |  7 +++++++
 lib/pp.rb                |  6 +++---
 test/ruby/test_object.rb | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 806667582..e5e198d51 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Wed Aug  5 01:38:27 2009  Yusuke Endoh  <mame@tsg.ne.jp>
+ 
+	* lib/pp.rb (guard_inspect_key): untrust internal hash to prevent
+	  unexpected SecurityError.
+
+	* test/ruby/test_object.rb: add a test for [ruby-dev:38982].
+
 Wed Aug  5 00:33:05 2009  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* lib/rdoc/parser/c.rb: fixed a small error in the documentation.
diff --git a/lib/pp.rb b/lib/pp.rb
index e28875c8e..a71ce9db3 100644
--- a/lib/pp.rb
+++ b/lib/pp.rb
@@ -107,17 +107,17 @@ class PP < PrettyPrint
   module PPMethods
     def guard_inspect_key
       if Thread.current[:__recursive_key__] == nil
-        Thread.current[:__recursive_key__] = {}
+        Thread.current[:__recursive_key__] = {}.untrust
       end
 
       if Thread.current[:__recursive_key__][:inspect] == nil
-        Thread.current[:__recursive_key__][:inspect] = {}
+        Thread.current[:__recursive_key__][:inspect] = {}.untrust
       end
 
       save = Thread.current[:__recursive_key__][:inspect]
 
       begin
-        Thread.current[:__recursive_key__][:inspect] = {}
+        Thread.current[:__recursive_key__][:inspect] = {}.untrust
         yield
       ensure
         Thread.current[:__recursive_key__][:inspect] = save
diff --git a/test/ruby/test_object.rb b/test/ruby/test_object.rb
index 51a3cdc32..eff463f30 100644
--- a/test/ruby/test_object.rb
+++ b/test/ruby/test_object.rb
@@ -413,4 +413,40 @@ class TestObject < Test::Unit::TestCase
     assert_equal(true, s.untrusted?)
     assert_equal(true, s.tainted?)
   end
+
+  def test_exec_recursive
+    Thread.current[:__recursive_key__] = nil
+    a = [[]]
+    a.inspect
+
+    assert_nothing_raised do
+      -> do
+        $SAFE = 4
+        begin
+          a.hash
+        rescue ArgumentError
+        end
+      end.call
+    end
+
+    -> do
+      assert_nothing_raised do
+        $SAFE = 4
+        a.inspect
+      end
+    end.call
+
+    -> do
+      o = Object.new
+      def o.to_ary(x); end
+      def o.==(x); $SAFE = 4; false; end
+      a = [[o]]
+      b = []
+      b << b
+
+      assert_nothing_raised do
+        b == a
+      end
+    end.call
+  end
 end
-- 
cgit