Allow per-class whitelisting of methods safe to expose through DRb #50

Closed
wants to merge 3 commits into
from

Projects

None yet

3 participants

@mohamedhafez

Allows the optional declaration of a whitelist of methods to expose through DRb for any class DRb will be sharing an instance of. (The current behavior of exposing all public methods of a class can leave a pretty scary security hole in some applications)

If drb_safe_methods is used in a class's definition, then any attempt to call a non-whitelisted method on that class through DRb will fail. There is no change to DRb's normal behavior if drb_safe_methods has not been called in a class's definition.

mohamedhafez added some commits Sep 27, 2011
@mohamedhafez mohamedhafez Allows the optional declaration of a whitelist of methods to expose t…
…hrough DRb for any class DRb will be sharing an instance of. (The current behavior of exposing all public methods of a class can leave a pretty scary security hole in some applications)


If drb_safe_methods is used in a class's definition, then any attempt to call a non-whitelisted method on that class through DRb will fail. There is no change to DRb's normal behavior if drb_safe_methods has not been called in a class's definition.
0be2422
@mohamedhafez mohamedhafez whoops, I was checking @front each time for the drb_safe_methods_list…
…, in order to deal correctly for DRbUndumped objects i needed to pass it the actual obj from check_insecure_method and check that instead
704c7a6
@shyouhei
Member

Hi. I forwarded this issue to our ITS:

http://redmine.ruby-lang.org/issues/5434

Please follow the discussion there. I can do the pull once you get consensus.

@mohamedhafez mohamedhafez I was accidentally classifying private methods, protected methods,and…
… unimplemented methods as insecure methods. this commit fixes that
96665e3
@zzak
Member
zzak commented Nov 18, 2012

Closing this as there is already an open ticket in redmine

@zzak zzak closed this Nov 18, 2012
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment