Remove bind method from Safemode::Scope #47
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The bind method could be used to execute arbitrary system commands by leveraging that things passed into it were getting eval'd without any escaping. This should remove the issue completely by making bind unavailable.
ofedoren
reviewed
Apr 28, 2023
There was a problem hiding this comment.
Thanks, @adamruzicka, looks sane, but I'm quite limited here, so just my two cents are:
| @@ -80,6 +80,10 @@ def test_interpolated_xstr_should_raise_security | |||
| assert_raise_security '"#{`ls -a`}"' | |||
| end | |||
|
|
|||
| def test_should_not_allow_access_to_bind | |||
| assert_raise_security "self.bind('an arg')" | |||
There was a problem hiding this comment.
Even though there is no longer bind method, is this possible to misuse get_binding directly instead?
There was a problem hiding this comment.
Not sure how.
The original issue was that one could call bind from a template and pass arguments to it, which were not treated safely. The arguments were just evaluated as-is to set values inside the binding. As far as I understand there wasn't anything inherently unsafe about being able to retrieve the binding, apart from the way how it could be obtained.
ofedoren
reviewed
May 3, 2023
ofedoren
approved these changes
May 3, 2023
|
Alright, let's get this in |
|
Hi @adamruzicka can we get this released into a new gem? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The bind method could be used to execute arbitrary system commands by leveraging that things passed into it were getting eval'd without any escaping. This should remove the issue completely by making bind unavailable.