Skip to content

Commit 0f764a1

Browse files
iNecasdmitri-d
authored andcommitted
Remove inspect from allowed methods
The `inspect` method is pretty unsafe, as by default it includes a lot of data from the object.
1 parent 9711f57 commit 0f764a1

File tree

2 files changed

+4
-4
lines changed

2 files changed

+4
-4
lines changed

lib/safemode/blankslate.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
module Safemode
22
class Blankslate
3-
@@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
4-
@@allow_class_methods = ['methods', 'new', 'name', 'inspect', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
3+
@@allow_instance_methods = ['class', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
4+
@@allow_class_methods = ['methods', 'new', 'name', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
55

66
silently { undef_methods(*instance_methods.map(&:to_s) - @@allow_instance_methods) }
77
class << self

test/test_jail.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ def test_sending_to_jail_to_an_object_should_return_a_jail
1919
end
2020

2121
def test_jail_instances_should_have_limited_methods
22-
expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
22+
expected = ["class", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
2323
expected.delete('respond_to_missing?') if RUBY_VERSION > '1.9.3' # respond_to_missing? is private in rubies above 1.9.3
2424
objects.each do |object|
2525
assert_equal expected.sort, reject_pretty_methods(object.to_jail.methods.map(&:to_s).sort)
2626
end
2727
end
2828

2929
def test_jail_classes_should_have_limited_methods
30-
expected = ["new", "methods", "name", "inherited", "method_added", "inspect",
30+
expected = ["new", "methods", "name", "inherited", "method_added",
3131
"allow", "allowed?", "allowed_methods", "init_allowed_methods",
3232
"<", # < needed in Rails Object#subclasses_of
3333
"ancestors", "==" # ancestors and == needed in Rails::Generator::Spec#lookup_class

0 commit comments

Comments
 (0)