Bug #10209: attr_reader vulnerability

• Status: Rejected
• Assignee: -
• Target version: -
• ruby -v: ruby 2.0.0p247 (2013-06-27) [i586-linux]
• Backport: 2.0.0: UNKNOWN, 2.1: UNKNOWN

[crojas (Carlos Luis Rojas Aragonés)]

It is possible to change a read_only class attribute:

require 'pp'
class Attributes
  attr_reader :string, :array, :hash
  def initialize
    @string = 'value'
    @array = [1, 2, 3, 4]
    @hash = { name: 'Carlos', age: 25 }
  end
end

instance = Attributes.new
pp 'Original atributes:'
pp '-------------------------'
pp instance.string
pp instance.array
pp instance.hash
pp '-------------------------'

# bang!!
# this should not afect the original atribute.
instance.string.gsub!(/.*/, '')
instance.array.clear
instance.hash.clear

pp 'After Hacking attributes:'
pp '-------------------------'
pp instance.string
pp instance.array
pp instance.hash
pp '-------------------------'

[crojas (Carlos Luis Rojas Aragonés)]

Output:

"Original atributes:"
"-------------------------"
"value"
[1, 2, 3, 4]
{:name=>"Carlos", :age=>25}
"-------------------------"
"After Hacking attributes:"
"-------------------------"
""
[]
{}
"-------------------------"

[jeremyevans0 (Jeremy Evans)]

This isn't a vulnerability, it's expected behavior. If you don't want to allow modification of an object, freeze the object.

[crojas (Carlos Luis Rojas Aragonés)]

mmm I think IMHO that the attr_reader accessor should return a .dub version of the object. That way there will be no chance to edit the class attribute on a read action.

[nobu (Nobuyoshi Nakada)]

• Status changed from Open to Rejected

A spec.

[nobu (Nobuyoshi Nakada)]

• Description updated (diff)

And, when you wonder if it is a vulnerability, please feel free to post to [e-mail], instead of an issue here.