Class: Ruote::TreeChecker

Inherits:
Object
  • Object
show all
Defined in:
lib/ruote/svc/treechecker.rb

Overview

The TreeChecker service is used to check incoming external ruby code and raise a security error if it contains potentially evil code.

Instance Method Summary collapse

Constructor Details

#initialize(context) ⇒ TreeChecker 



38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
 
# File 'lib/ruote/svc/treechecker.rb', line 38

def initialize(context)

  return if context['use_ruby_treechecker'] == false

  checker = Rufus::TreeChecker.new do

    exclude_fvccall :abort, :exit, :exit!
    exclude_fvccall :system, :fork, :syscall, :trap, :require, :load
    exclude_fvccall :at_exit

    #exclude_call_to :class
    exclude_fvcall :private, :public, :protected

    #exclude_raise             # no raise or throw

    exclude_eval              # no eval, module_eval or instance_eval
    exclude_backquotes        # no `rm -fR the/kitchen/sink`
    exclude_alias             # no alias or aliast_method
    exclude_global_vars       # $vars are off limits
    exclude_module_tinkering  # no module opening

    exclude_rebinding Kernel # no 'k = Kernel'

    exclude_access_to(
      IO, File, FileUtils, Process, Signal, Thread, ThreadGroup)

    #exclude_class_tinkering :except => Ruote::ProcessDefinition
      #
      # excludes defining/opening any class except
      # Ruote::ProcessDefinition

    exclude_call_to :instance_variable_get, :instance_variable_set
  end

  stricter_checker = checker.clone
  stricter_checker.add_rules do
    exclude_def    # no method definition
    exclude_raise  # no raise or throw
  end

  # the checker used when reading process definitions

  @def_checker = stricter_checker.clone # and not dup
  @def_checker.freeze

  ## the checker used when dealing with conditionals
  #
  #@con_checker = checker.clone # and not dup
  #@con_checker.add_rules do
  #  exclude_raise # no raise or throw
  #  at_root do
  #    exclude_head [ :block ] # preventing 'a < b; do_sthing_evil()'
  #    exclude_head [ :lasgn ] # preventing 'a = 3'
  #  end
  #end
  #@con_checker.freeze
    #
    # lib/ruote/exp/condition.rb doesn't use this treechecker
    # kept (commented out) for 'documentation'

  # the checker used when dealing with code in $(ruby:xxx}

  @dol_checker = stricter_checker.clone # and not dup
  @dol_checker.freeze

  # the checker used when dealing with BlockParticipant code

  @blo_checker = checker.clone # and not dup
  @blo_checker.add_rules do
    exclude_def    # no method definition
  end
  @blo_checker.freeze

  # the checker used for CodeParticipant

  @cod_checker = checker.clone # and not dup
  @cod_checker.freeze

  freeze
    # preventing further modifications
end

Instance Method Details

#block_check(ruby_code) ⇒ Object 



125
126
127
128
 
# File 'lib/ruote/svc/treechecker.rb', line 125

def block_check(ruby_code)

  @blo_checker.check(ruby_code) if @blo_checker
end

#code_check(ruby_code) ⇒ Object 



135
136
137
138
 
# File 'lib/ruote/svc/treechecker.rb', line 135

def code_check(ruby_code)

  @cod_checker.check(ruby_code) if @cod_checker
end

#definition_check(ruby_code) ⇒ Object 



120
121
122
123
 
# File 'lib/ruote/svc/treechecker.rb', line 120

def definition_check(ruby_code)

  @def_checker.check(ruby_code) if @def_checker
end

#dollar_check(ruby_code) ⇒ Object 



130
131
132
133
 
# File 'lib/ruote/svc/treechecker.rb', line 130

def dollar_check(ruby_code)

  @dol_checker.check(ruby_code) if @dol_checker
end