This removes the security features added by $SAFE = 1, and warns for access
or modification of $SAFE from Ruby-level, as well as warning when calling
all public C functions related to $SAFE.
This modifies some internal functions that took a safe level argument
to no longer take the argument.
rb_require_safe now warns, rb_require_string has been added as a
version that takes a VALUE and does not warn.
One public C function that still takes a safe level argument and that
this doesn't warn for is rb_eval_cmd. We may want to consider
adding an alternative method that does not take a safe level argument,
and warn for rb_eval_cmd.
is given.
This is merging Eric's patch in [Bug #15479] to Ruby 2.6's behavior in r66631.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@66632 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This reverts commit b5569b9ab2.
The deprecation is indefinitely postponed.
[Bug #15478]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@66631 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This was planned to be removed in Ruby 2.7 at first, but I changed my
mind to just keep warning it in Ruby 2.7.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@66556 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
I changed my mind and thought branching ERB.new in all libraries is too
hard. Code becomes too ugly. I increased the warn level to 2, and the
old initializer will be removed when Ruby 2.5 becomes EOL.
-S option of erb(1) stays in the same policy: will be removed at Ruby 2.7.
NEWS: note about the direction
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62612 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Also, as it's in the middle of the list of 4 arguments, 3rd and 4th arguments
(trim_mode, eoutvar) are changed to keyword arguments.
Old ways to specify arguments are deprecated and warned now.
bin/erb: deprecate -S option.
We'll remove all of deprecated ones at Ruby 2.7+.
enc/make_encmake.rb: stopped using deprecated interface
ext/etc/mkconstants.rb: ditto
ext/socket/mkconstants.rb: ditto
sample/ripper/ruby2html.rb: ditto
spec/ruby/library/erb/defmethod/def_erb_method_spec.rb: ditto
spec/ruby/library/erb/new_spec.rb: ditto
test/erb/test_erb.rb: ditto
test/erb/test_erb_command.rb: ditto
tool/generic_erb.rb: ditto
tool/ruby_vm/helpers/dumper.rb: ditto
tool/transcode-tblgen.rb: ditto
lib/rdoc/erbio.rb: ditto
lib/rdoc/generator/darkfish.rb: ditto
[Feature #14256]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@62529 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* vm_core.h (rb_vm_t): move `rb_execution_context_t::safe_level` to
`rb_vm_t::safe_level_` because `$SAFE` is a process (VM) global state.
* vm_core.h (rb_proc_t): remove `rb_proc_t::safe_level` because `Proc`
objects don't need to keep `$SAFE` at the creation.
Also make `is_from_method` and `is_lambda` as 1 bit fields.
* cont.c (cont_restore_thread): no need to keep `$SAFE` for Continuation.
* eval.c (ruby_cleanup): use `rb_set_safe_level_force()` instead of access
`vm->safe_level_` directly.
* eval_jump.c: End procs `END{}` doesn't keep `$SAFE`.
* proc.c (proc_dup): removed and introduce `rb_proc_dup` in vm.c.
* safe.c (rb_set_safe_level): don't check `$SAFE` 1 -> 0 changes.
* safe.c (safe_setter): use `rb_set_safe_level()`.
* thread.c (rb_thread_safe_level): `Thread#safe_level` returns `$SAFE`.
It should be obsolete.
* transcode.c (load_transcoder_entry): `rb_safe_level()` only returns
0 or 1 so that this check is not needed.
* vm.c (vm_proc_create_from_captured): don't need to keep `$SAFE` for Proc.
* vm.c (rb_proc_create): renamed to `proc_create`.
* vm.c (rb_proc_dup): moved from proc.c.
* vm.c (vm_invoke_proc): do not need to set and restore `$SAFE`
for `Proc#call`.
* vm_eval.c (rb_eval_cmd): rename a local variable to represent clearer
meaning.
* lib/drb/drb.rb: restore `$SAFE`.
* lib/erb.rb: restore `$SAFE`, too.
* test/lib/leakchecker.rb: check `$SAFE == 0` at the end of tests.
* test/rubygems/test_gem.rb: do not set `$SAFE = 1`.
* bootstraptest/test_proc.rb: catch up this change.
* spec/ruby/optional/capi/string_spec.rb: ditto.
* test/bigdecimal/test_bigdecimal.rb: ditto.
* test/fiddle/test_func.rb: ditto.
* test/fiddle/test_handle.rb: ditto.
* test/net/imap/test_imap_response_parser.rb: ditto.
* test/pathname/test_pathname.rb: ditto.
* test/readline/test_readline.rb: ditto.
* test/ruby/test_file.rb: ditto.
* test/ruby/test_optimization.rb: ditto.
* test/ruby/test_proc.rb: ditto.
* test/ruby/test_require.rb: ditto.
* test/ruby/test_thread.rb: ditto.
* test/rubygems/test_gem_specification.rb: ditto.
* test/test_tempfile.rb: ditto.
* test/test_tmpdir.rb: ditto.
* test/win32ole/test_win32ole.rb: ditto.
* test/win32ole/test_win32ole_event.rb: ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61510 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
comment. Fix regression at r58948.
I even don't want to deprecate it because deprecation needs to lex all
embedded Ruby script using Ripper and it would be slow. So Let me just
keep this behavior of Ruby 2.4. No change is the best compatibility.
This commit stopped using String#-@ because it's harmful for "ambiguous
first argument" warning if we really want to maintain this behavior.
[Bug #14243]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61497 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/erb.rb (ERB#new_toplevel): shadow already defined local
variables by block local variabes, not to overwrite them.
[ruby-core:84390] [Bug #14215]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61411 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
for compilation performance.
$ ruby ./benchmark/driver.rb -e "trunk::/Users/k0kubun/.rbenv/versions/trunk/bin/ruby;modified::/Users/k0kubun/.rbenv/versions/modified/bin/ruby" -d ./benchmark -p app_erb
-----------------------------------------------------------
benchmark results:
Execution time (sec)
name trunk modified
app_erb 1.911 1.885
Speedup ratio: compare with the result of `trunk' (greater is better)
name modified
app_erb 1.014
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60293 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This seems to be unreachable from first introduction at r21286.
In ERB implementation, `#empty?` is only called for each member of
return value of `String#scan`, and `ERB::Compiler::PercentLine` is never
returned from `String#scan`.
Also, in `ERB::Compiler#compile`, as it's yielded only when stag is nil,
methods called to `ERB::Compiler::PercentLine` object yielded from
`ERB::Compiler::TrimScanner#scan` are only: `#nil?`, `#==`, `to_s`.
Thus `ERB::Compiler::PercentLine#empty?` is never used.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60032 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
to skip unnecessary string allocation on frozen_string_literal: false.
str_uplus can bypass calling rb_str_dup when OBJ_FROZEN is true.
* Before
erb_render 1.064
* Afete
erb_render 0.909
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58916 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
by reducing string allocation.
* Before
app_erb 0.687
* After
app_erb 0.679
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58908 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
to skip object allocation for static string.
We can't always enable frozen_string_literal pragma because we can't
freeze string literals embedded by user for backward compatibility.
So we need to use fstring for each static string.
Since adding ".freeze" to string literals in #content_dump is slow
on compiling, I used unary "-" operator instead.
benchmark/bm_app_erb_render.rb: Added rendering-only benchmark to
test rendering performance on production environment.
This benchmark is created to reproduce the behavior on Sinatra (Tilt).
Thus it doesn't use ERB#result to skip parsing compiled code.
It doesn't use ERB#def_method too to regard `title` and `content` as
local variables. If we use #def_method, `title` and `content` needs
to be method call. I wanted to avoid it.
This patch's benchmark results is:
* Before
app_erb_render 1.250
app_erb 0.704
* After
app_erb_render 1.066
app_erb 0.686
This patch optimizes rendering performance (app_erb_render) without
spoiling (total of rendering +) compiling performance (app_erb).
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58905 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
The original intention of introducing `_erbout.force_encoding`
in r21170 was:
- "returns a string in the same character encoding as the input string."
- "When the input string has a magic comment, however, it returns a string
in the encoding specified by the magic comment."
And they are tested by test/erb/test_erb_m17n.rb well and this patch
passes the test.
Since magic comment is always added in ERB compiled code, using ''.dup
instead of String.new will set correct encoding without calling
force_encoding method.
The benchmark results are:
* Before
$ ./ruby benchmark/run.rb --matzruby=./ruby -m bm_app_erb
MatzRuby:
ruby 2.5.0dev (2017-05-26 skip-force-enc.. 58903) [x86_64-linux]
last_commit=Skip force_encoding in compiled code of erb
Ruby:
app_erb:
matz 0.715
* After
$ ./ruby benchmark/run.rb --matzruby=./ruby -m bm_app_erb
MatzRuby:
ruby 2.5.0dev (2017-05-26 skip-force-enc.. 58903) [x86_64-linux]
last_commit=Skip force_encoding in compiled code of erb
Ruby:
app_erb:
matz 0.672
And perf(1) results are:
* Before
$ sudo perf stat ./ruby benchmark/bm_app_erb.rb
Performance counter stats for './ruby benchmark/bm_app_erb.rb':
709.571746 task-clock (msec) # 1.000 CPUs utilized
5 context-switches # 0.007 K/sec
1 cpu-migrations # 0.001 K/sec
1,337 page-faults # 0.002 M/sec
3,088,936,521 cycles # 4.353 GHz
<not supported> stalled-cycles-frontend
<not supported> stalled-cycles-backend
4,849,564,282 instructions # 1.57 insns per cycle
1,027,042,087 branches # 1447.411 M/sec
19,983,456 branch-misses # 1.95% of all branches
0.709747823 seconds time elapsed
* After
$ sudo perf stat ./ruby benchmark/bm_app_erb.rb
Performance counter stats for './ruby benchmark/bm_app_erb.rb':
693.494673 task-clock (msec) # 1.000 CPUs utilized
7 context-switches # 0.010 K/sec
1 cpu-migrations # 0.001 K/sec
1,316 page-faults # 0.002 M/sec
3,025,639,349 cycles # 4.363 GHz
<not supported> stalled-cycles-frontend
<not supported> stalled-cycles-backend
4,694,848,271 instructions # 1.55 insns per cycle
994,496,704 branches # 1434.037 M/sec
19,693,239 branch-misses # 1.98% of all branches
0.693724345 seconds time elapsed
[fix GH-1147]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58904 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
if stags and etags are not changed from default.
:putobject insn (of regexp) will be used instead of :toregexp insn.
This means that the regexp won't be compiled for every
`SimpleScanner#scan` call.
It may not be a good idea to apply this kind of optimization for all cases.
But I applied this because it is default scanner and used frequently and has
relatively large impact for benchmark like this:
* Before
app_erb 1.023
* After
app_erb 0.781
This commit fixes only the bottleneck of performance regression introduced
in r53412. For maintainability, I won't fix other small regressions like
additional overhead of method calls.
[ruby-core:73820] [Bug #12074]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58842 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
when trim_mode is "-", for Windows environments.
[ruby-core:39625] [Bug #5339]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58825 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
when trim_mode is "<>", for Windows environments.
[Bug #11464]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58823 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
of LoadError in some method calls, not from `require "strscan"`.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58822 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Original `SimpleScanner` was used only in tests.
Since `SimpleScanner` and `SimpleScanner2` work in the same way, I want
to drop the one which can't be used in a normal situation.
The only difference was `SimpleScanner` can be loaded without strscan
dependency but I think there's no situation that strscan is unavailable
because it's a standard library.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58819 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Based on patch by madeofcode (Mark Dodwell).
[ruby-core:46168] [Bug #6696] [Fix GH-54]
`~` is a unreserved character.
https://tools.ietf.org/html/rfc3986#section-2.3
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58772 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/erb.rb (ERB::Compiler::TrimScanner#stag): The :stag accessor
has already been available because it is defined in parent
Scanner class. [Fix GH-1445]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@56238 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/erb.rb (ERB::Compiler#detect_magic_comment): allow
fronzen-string-literal in comment as well as encoding.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53685 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/erb.rb (ERB#def_method): insert def line just before the
first non-comment and non-empty line, not to leave duplicated
and stale magic comments.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53684 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/erb.rb (ERB#set_eoutvar): explicitly make mutable string as
a buffer to make ERB work with --enable-frozen-string-literal.
[ruby-core:73561] [Bug #12031]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53682 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
We should try with Ruby 2.4 or 3.0.
[Bug #11842][ruby-core:72374]
* lib/rdoc/erb_partial.rb: ditto.
* template/verconf.h.tmpl: ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53216 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
When you change this to true, you may need to add more tests.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@53141 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* bin/erb (ARGV.switch, ERB::Main#run): allow variables to be set
from the command line. [ruby-core:65772] [Feature #10395]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@48786 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/erb.rb (ERB#lineno): accessor for line number to eval.
* lib/erb.rb (ERB#location=): setter of file name and line number.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@48785 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
"UTF-8" is invalid encoding name in Emacs, use "utf-8" instead.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@46948 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Jeremy Evans
zverok
nobu
k0kubun
kazu
ko1
marcandre
naruse
a_matsuda
seki
hsbt