jmettraux / rufus-treechecker

checking ruby sexp trees [before eval()], raise security error if excluded code pattern spotted

This URL has Read+Write access

cosmetic changes
jmettraux (author)
Mon May 11 22:54:46 -0700 2009
commit  c27b5fa7e2bcb81262f619496c84a76660ad7eef
tree    cf248d3d378eb29cffa7af323f8b87f1d48f504b
parent  845820d87f1abf1db3e9a6f791727147c36725b3
rufus-treechecker / README.txt
100644 97 lines (50 sloc) 1.908 kb
raw blame history 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97

= 'rufus-treechecker'
 
== what is it ?
 
Initialize a Rufus::TreeChecker and pass some ruby code to make sure it's safe before calling eval().
 
 
== getting it
 
    sudo gem install -y rufus-treechecker
 
or download[http://rubyforge.org/frs/?group_id=4812] it from RubyForge.
 
 
== usage
 
The treechecker uses ruby_parser (http://rubyforge.org/projects/parsetree)
to turn Ruby code into s-expressions, the treechecker then 
checks this sexp tree and raises a Rufus::SecurityError if an excluded pattern 
is spotted.
 
The excluded patterns are defined at the initialization of the TreeChecker
instance by listing rules.
 
    require 'rubygems'
    require 'rufus-treechecker'
 
    tc = Rufus::TreeChecker.new do
      exclude_fvcall :abort
      exclude_fvcall :exit, :exit!
    end
    
    tc.check("1 + 1; abort")               # will raise a SecurityError
    tc.check("puts (1..10).to_a.inspect")  # OK
 
 
Nice, but how do I know what to exclude ?
 
    require 'rubygems'
    require 'rufus-treechecker'
 
    Rufus::TreeChecker.new.ptree('a = 5 + 6; puts a')
 
will yield
 
    "a = 5 + 6; puts a"
     => 
     [:block, 
       [:lasgn, :a, [:call, [:lit, 5], :+, [:array, [:lit, 6]]]], 
       [:fcall, :puts, [:array, [:lvar, :a]]]
     ]
 
 
For more documentation, see http://github.com/jmettraux/rufus-treechecker/tree/master/lib/rufus/treechecker.rb
 
 
== dependencies
 
the 'ruby_parser' gem by Ryan Davis.
 
 
== mailing list
 
On the Rufus-Ruby list[http://groups.google.com/group/rufus-ruby] :
 
    http://groups.google.com/group/rufus-ruby
 
 
== issue tracker
 
    http://rubyforge.org/tracker/?atid=18584&group_id=4812&func=browse
 
 
== source
 
http://github.com/jmettraux/rufus-treechecker
 
    git clone git://github.com/jmettraux/rufus-treechecker.git
 
 
== author
 
John Mettraux, jmettraux@gmail.com,
http://jmettraux.wordpress.com
 
 
== the rest of Rufus
 
http://rufus.rubyforge.org
 
 
== license
 
MIT