class Module

Adds the sandboxed_methods and not_sandboxed_methods to Module class so it is avialble to all classes.

Public Instance Methods

not_sandboxed_methods(include_superclasses = false, allowed_mixins=[], *disallowed_methods) click to toggle source

Shortcut to allow everything except a few methods

This will not include any superclass methods unless include_superclasses = true

Example

class SomeClass
  not_sandboxed_methods :unsafe_method
  def some_method
    "this is ok to call"
  end
  def unsafe_method
    "this is NOT ok to call"
  end
end
# File lib/sandboxed_erb/sandbox_methods.rb, line 72
def not_sandboxed_methods(include_superclasses = false, allowed_mixins=[], *disallowed_methods)

  __the_methods_to_check = public_instance_methods(false)
  puts "#{self.name}: direct: #{__the_methods_to_check.inspect}" if $DEBUG
  if include_superclasses
    clz = self.superclass
    while !clz.nil?
      unless clz == Object || (defined? BasicObject && clz == BasicObject)
        puts "#{self.name}: #{clz.name}: #{clz.public_instance_methods(false).inspect}" if $DEBUG
        __the_methods_to_check += clz.public_instance_methods(false)
      end
      clz = clz.superclass
    end
    
    if allowed_mixins.length > 0
      #we include any mixins
      for m in self.included_modules
        if allowed_mixins.include?(m)
          puts "#{self.name}: #{m.name}: #{m.public_instance_methods(false).inspect}" if $DEBUG
          __the_methods_to_check += m.public_instance_methods(false)
        end
      end
    end
  end
  
  __the_methods_to_check << "nil?".intern
  
  __the_methods_to_check.uniq!
  
  unless disallowed_methods.nil? || disallowed_methods.length == 0
    not_bang = false
    if disallowed_methods.include?(:bang_methods) #just remove all xxx! methods that modify in place
      __the_methods_to_check.reject! { |meth| meth.to_s[-1, 1] == "!"}
      not_bang = true
    end
    unless not_bang || disallowed_methods.length > 1
      __the_methods_to_check.reject! { |meth| disallowed_methods.include?(meth)}
    end
  end
  
  puts "#{self.name}: #{__the_methods_to_check.inspect}" if $DEBUG
   
  sandboxed_methods(*__the_methods_to_check)
  
  
  
end
sandboxed_methods(*allowed_methods) click to toggle source

Specify what methods you want to be accessable from the sandbox.

Example

class SomeClass
  sandboxed_methods :some_method
  def some_method
    "this is ok to call"
  end
end

If the object has a method called set_sandbox_context, it will be passed the sandbox_context, which is a map containing the context passed to SandboxedErb::Template.run, as well as another entry keys to :locals which contains the locals map passed to run.

# File lib/sandboxed_erb/sandbox_methods.rb, line 36
def sandboxed_methods(*allowed_methods)
  _sb_allowed_methods_map = {}
  allowed_methods.each { |meth|
    _sb_allowed_methods_map[meth.to_s.intern] = true
  }

  define_method :_sbm do |meth, sandbox_context, *args|
    if _sb_allowed_methods_map[meth]
      self.set_sandbox_context(sandbox_context) if self.respond_to?(:set_sandbox_context)
      begin
        self.__send__(meth, *args)
      rescue Exception=>e
        raise "Error calling #{meth}: #{e.message}"
      end
    else
      puts _sb_allowed_methods_map.inspect if $DEBUG
      raise SandboxedErb::MissingMethodError, "Unknown method '#{meth}' on object '#{self.class.name}'"
    end
  end
end