@@ -23,10 +23,9 @@ post '/' do data = params[:data] tmpdir = "tmp/#{repo}" - tmpdir = "." spec = nil - #`git clone --depth 1 git://github.com/#{repo} #{tmpdir}` + `git clone --depth 1 git://github.com/#{repo} #{tmpdir}` Dir.chdir(tmpdir) do Thread.new do spec = eval <<-EOE @@ -53,10 +52,10 @@ post '/' do spec.rubygems_version = Gem::RubyGemsVersion # make sure validation passes spec.validate end - #`rm -rf #{tmpdir}` + `rm -rf #{tmpdir}` w.write YAML.dump(spec) rescue Object => e - #`rm -rf #{tmpdir}` + `rm -rf #{tmpdir}` puts e puts e.backtrace w.write "ERROR: #{e}" gem_eval.rb @@ -16,8 +16,6 @@ Kernel.freeze # disable ObjectSpace Object.send :remove_const, :ObjectSpace - -#TODO: use gsub to run any code you want # make sure all string methods which modify self also taint the string class String %w(swapcase! strip! squeeze! reverse! downcase! upcase! delete! slice! replace []= <<).each do |method_name| security.rb @@ -46,8 +46,8 @@ Thread.new do $SAFE = 3 Dir.set_safe_level assert_raises SecurityError, "snuck tainted string past glob" do - p Dir['**','**'] - p Dir.glob(['**', '**']) + Dir['**','**'] + Dir.glob(['**', '**']) end end.join Dir.set_safe_level security_test.rb 0260380e375d2dd0e1a8fcab15f91ce56dbe778e steve coderrr.contact@gmail.com http://github.com/pjhyett/github-gem-builder/commit/ca9fd470bacb6262eb4ca23ee48bb2f43711c1ff ca9fd470bacb6262eb4ca23ee48bb2f43711c1ff 2008-10-31T05:30:23-07:00 2008-10-31T05:30:23-07:00 remove debug comments 40a501ee939625124f5757d251ddcc200d8b4548 steve coderrr.contact@gmail.com