&. is not allowed inside LHS of massign

https://hackerone.com/reports/605262
ruby · Jun 11, 2019 · 140b811 · 140b811
1 parent 42ac889
commit 140b811
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/parse.y b/parse.y
@@ -1787,6 +1787,9 @@ mlhs_node	: user_variable
 		    }
 		| primary_value call_op tIDENTIFIER
 		    {
+			if ($2 == tANDDOT) {
+			    yyerror1(&@2, "&. inside LHS of multiple assignment");
+			}
 		    /*%%%*/
 			$$ = attrset(p, $1, $2, $3, &@$);
 		    /*% %*/
@@ -1801,6 +1804,9 @@ mlhs_node	: user_variable
 		    }
 		| primary_value call_op tCONSTANT
 		    {
+			if ($2 == tANDDOT) {
+			    yyerror1(&@2, "&. inside LHS of multiple assignment");
+			}
 		    /*%%%*/
 			$$ = attrset(p, $1, $2, $3, &@$);
 		    /*% %*/

diff --git a/test/ruby/test_syntax.rb b/test/ruby/test_syntax.rb
@@ -976,6 +976,11 @@ def test_fluent_dot
     assert_valid_syntax("a\n.:foo")
   end
 
+  def test_safe_call_in_massign_lhs
+    assert_syntax_error("*a&.x=0", /LHS/)
+    assert_syntax_error("a&.x,=0", /LHS/)
+  end
+
   def test_no_warning_logop_literal
     assert_warning("") do
       eval("true||raise;nil")