erb.rb: prohibit marshaling [EXPERIMENTAL]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@67356 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2019-03-28 03:46:48 +00:00
Родитель 978290515e
Коммит b3507bf147
2 изменённых файлов: 17 добавлений и 0 удалений

Просмотреть файл

@ -833,6 +833,7 @@ class ERB
@src, @encoding, @frozen_string = *compiler.compile(str) @src, @encoding, @frozen_string = *compiler.compile(str)
@filename = nil @filename = nil
@lineno = 0 @lineno = 0
@_init = self.class.singleton_class
end end
NOT_GIVEN = Object.new NOT_GIVEN = Object.new
private_constant :NOT_GIVEN private_constant :NOT_GIVEN
@ -891,6 +892,9 @@ class ERB
# code evaluation. # code evaluation.
# #
def result(b=new_toplevel) def result(b=new_toplevel)
unless @_init.equal?(self.class.singleton_class)
raise ArgumentError, "not initialized"
end
if @safe_level if @safe_level
proc do proc do
prev_safe_level = $SAFE prev_safe_level = $SAFE

Просмотреть файл

@ -687,6 +687,19 @@ EOS
end end
end end
end end
def test_prohibited_marshal_dump
erb = ERB.new("")
assert_raise(TypeError) {Marshal.dump(erb)}
end
def test_prohibited_marshal_load
erb = ERB.allocate
erb.instance_variable_set(:@src, "")
erb.instance_variable_set(:@lineno, 1)
erb = Marshal.load(Marshal.dump(erb))
assert_raise(ArgumentError) {erb.result}
end
end end
class TestERBCoreWOStrScan < TestERBCore class TestERBCoreWOStrScan < TestERBCore