JRuby

Invalid instance/class variable and constant names may be set

Details

  • Number of attachments :
    0

Description

The IdUtil.isXXX methods do not sufficiently validate names passed to const_set, instance_variable_set and class_variable_set. (Likewise for the get methods, but that's less problematic.) So, for example, the following are currently accepted:

mod.const_set 'A nice, long phrase!', 86
obj.instance_variable_set '@1 * @2 / @3 =', 4
clazz.send :class_variable_set, '@@@@@@@@', 99

I've got a fix in the works, part of other ivar/cvar/constant work.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Thomas E Enebo added a comment -

Don't fix getVarType as part of this. It is used by the parser/lexer code and does not need extra sanity checks (lexer already does it). I can either move that function into that area or you can comment why it does not have extra checks on it.

Show
Thomas E Enebo added a comment - Don't fix getVarType as part of this. It is used by the parser/lexer code and does not need extra sanity checks (lexer already does it). I can either move that function into that area or you can comment why it does not have extra checks on it.
Hide
Permalink
Bill Dortch added a comment -

Re: ...getVarType ... does not need extra sanity checks ..

I figured as much, created separate isValidXXX methods...

Show
Bill Dortch added a comment - Re: ...getVarType ... does not need extra sanity checks .. I figured as much, created separate isValidXXX methods...
Hide
Permalink
Bill Dortch added a comment -

Fixed on trunk in 4217. Leaving open pending unit tests and replication to 1_0.

Show
Bill Dortch added a comment - Fixed on trunk in 4217. Leaving open pending unit tests and replication to 1_0.
Hide
Permalink
Charles Oliver Nutter added a comment -

Over a month old now; if this is going to be backported to 1.0, do it soon, or we're going to close it as a 1.1-only fix.

Show
Charles Oliver Nutter added a comment - Over a month old now; if this is going to be backported to 1.0, do it soon, or we're going to close it as a 1.1-only fix.
Hide
Permalink
Bill Dortch added a comment -

Fixed for 1_0 branch in 4478, 4479. Unit tests added to trunk in 4480.

Show
Bill Dortch added a comment - Fixed for 1_0 branch in 4478, 4479. Unit tests added to trunk in 4480.

People

  • Assignee:
    Bill Dortch
    Reporter:
    Bill Dortch
Vote (0)
Watch (0)

Dates

  • Created:
    Updated:
    Resolved: