mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
[ruby/net-protocol] Get rid of __send__
Mitigate the security risk: https://devcraft.io/2021/01/07/universal-deserialisation-gadget-for-ruby-2-x-3-x.html https://github.com/ruby/net-protocol/commit/a9970437e8
This commit is contained in:
parent
f4640f64a4
commit
2b17d2f297
1 changed files with 5 additions and 6 deletions
|
@ -383,7 +383,7 @@ module Net # :nodoc:
|
|||
len = writing {
|
||||
using_each_crlf_line {
|
||||
begin
|
||||
block.call(WriteAdapter.new(self, :write_message_0))
|
||||
block.call(WriteAdapter.new(self.method(:write_message_0)))
|
||||
rescue LocalJumpError
|
||||
# allow `break' from writer block
|
||||
end
|
||||
|
@ -447,17 +447,16 @@ module Net # :nodoc:
|
|||
# The writer adapter class
|
||||
#
|
||||
class WriteAdapter
|
||||
def initialize(socket, method)
|
||||
@socket = socket
|
||||
@method_id = method
|
||||
def initialize(writer)
|
||||
@writer = writer
|
||||
end
|
||||
|
||||
def inspect
|
||||
"#<#{self.class} socket=#{@socket.inspect}>"
|
||||
"#<#{self.class} writer=#{@writer.inspect}>"
|
||||
end
|
||||
|
||||
def write(str)
|
||||
@socket.__send__(@method_id, str)
|
||||
@writer.call(str)
|
||||
end
|
||||
|
||||
alias print write
|
||||
|
|
Loading…
Reference in a new issue