1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* doc/security.rdoc: [DOC] update symbols section [ci-skip]

Browse Source 
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@49496 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
marcandre 2015-02-04 16:24:16 +00:00
parent 99eaebcea3
commit 229bfa7bb1
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
doc/security.rdoc
View File

@ -66,16 +66,26 @@ method, variable and constant names. The reason for this is that symbols are
simply integers with names attached to them, so they are faster to look up in simply integers with names attached to them, so they are faster to look up in
hashtables. hashtables.
Be careful with passing user input to methods such as +send+, Starting in version 2.2, most symbols can be garbage collected; these are
+instance_variable_get+ or +_set+, +const_get+ or +_set+, etc. called <i>mortal</i> symbols. Most symbols you create (e.g. by calling
as these methods will convert string parameters to immortal symbols internally. +to_sym+) are mortal.
This means that the memory used by the symbols are never freed. This could
<i>Immortal</i> symbols on the other hand will never be garbage collected.
They are created when modifying code:
* defining a method (e.g. with +define_method+),
* setting an instance variable (e.g. with +instance_variable_set+),
* creating a variable or constant (e.g. with +const_set+)
Also, C extensions that have not been updated and are still calling `ID2SYM`
will create immortal symbols.
Don't create immortal symbols from user inputs. Otherwise, this would
allow a user to mount a denial of service attack against your application by allow a user to mount a denial of service attack against your application by
flooding it with unique strings, which will cause memory to grow indefinitely flooding it with unique strings, which will cause memory to grow indefinitely
until the Ruby process is killed or causes the system to slow to a halt. until the Ruby process is killed or causes the system to slow to a halt.
The workaround to this is simple - don't call reflection/metaprogramming While it might not be a good idea to call these with user inputs, methods that
methods with user input. used to be vulnerable such as +to_sym+, +send+, +respond_to?+,
+method+, +instance_variable_get+, +const_get+, etc. are no longer a threat.
== Regular expressions == Regular expressions