Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Lint/ShadowedException to block arbitrary code execution #3269

Conversation

pocke
Copy link
Collaborator

@pocke pocke commented Jul 1, 2016

Problem

Lint/ShadowedException cop has an security risk.
An attacker can execute arbitrary code on a rubocop executing computer.

Reproduce

# test.rb
begin
  something
rescue puts('Arbitrary-code-execution!')
  handle_exception
rescue RuntimeError
  handle_standard_error
end
$ rubocop test.rb  --only Lint/ShadowedException --cache false
Inspecting 1 file
Arbitrary-code-execution!
.

1 file inspected, no offenses detected

Change

The cop evaluates const expressions only.
Other expressions(variables, method call, ....) are ignored.


Before submitting the PR make sure the following are checked:

  • Wrote good commit messages.
  • Commit message starts with [Fix #issue-number] (if the related issue exists).
  • Used the same coding conventions as the rest of the project.
  • Feature branch is up-to-date with master (if not - rebase it).
  • Squashed related commits together.
  • Added tests.
  • Added an entry to the Changelog if the new code introduces user-observable changes. See changelog entry format.
  • All tests are passing.
  • The new code doesn't generate RuboCop offenses.
  • The PR relates to only one subject with a clear title
    and description in grammatically correct, complete sentences.

@pocke pocke force-pushed the shadowed-exception-has-arbitrary-code-execution branch 2 times, most recently from 447f47a to 5201e43 Compare July 1, 2016 07:27
@@ -327,5 +327,17 @@

expect(cop.offenses).to be_empty
end

it 'accepts rescuing some expressions' do
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This description is a bit vague.

@pocke pocke force-pushed the shadowed-exception-has-arbitrary-code-execution branch from 5201e43 to 498029f Compare July 2, 2016 07:54
@pocke
Copy link
Collaborator Author

pocke commented Jul 2, 2016

@bbatsov Fixed the description

@pocke pocke force-pushed the shadowed-exception-has-arbitrary-code-execution branch from 498029f to 54260ba Compare July 3, 2016 01:04
@bbatsov
Copy link
Collaborator

bbatsov commented Jul 4, 2016

Hmm, the build is failing for Ruby 1.9.3. Seem that the json gem dropped support for 1.9.3...

@bbatsov
Copy link
Collaborator

bbatsov commented Jul 5, 2016

The build is affected by #3278

@bbatsov bbatsov merged commit 1d71c51 into rubocop:master Jul 6, 2016
@pocke pocke deleted the shadowed-exception-has-arbitrary-code-execution branch July 7, 2016 05:18
Neodelf pushed a commit to Neodelf/rubocop that referenced this pull request Oct 15, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants