module WebSandboxConsole::SafeRuby
Public Instance Methods
<<(data_arr)
click to toggle source
支持类型 csv 数据写入方式
# File lib/web_sandbox_console/safe_ruby.rb, line 107 def << (data_arr) self.info data_arr.join(",") + "\n" end
blacklist_method_remind()
click to toggle source
当拦截黑名单方法时提醒
# File lib/web_sandbox_console/safe_ruby.rb, line 141 def blacklist_method_remind Kernel.class_exec do # 发现此处method_missing Array 没有flatten方法 def flatten_arr(arr) new_arr = [] arr.each do |e| if e.is_a?(Array) new_arr.concat(flatten_arr(e)) else new_arr << e end end new_arr end def method_missing(name,*params) class_methods = WebSandboxConsole.class_method_blacklists.values instance_methods = WebSandboxConsole.instance_method_blacklists.values if flatten_arr([class_methods, instance_methods]).include?(name.to_sym) msg = "PS:当前代码执行过程中可能调用了黑名单方法,若代码正常返回,请忽略此条提醒" WebSandboxConsole.log_p(msg, true) end super end end end
class_method_blacklists()
click to toggle source
类方法黑名单列表
# File lib/web_sandbox_console/safe_ruby.rb, line 38 def class_method_blacklists blacklist = if class_method_blacklist merge_method_hash(CLASS_METHOD_BUILT_IN_BLACKLIST, class_method_blacklist) else CLASS_METHOD_BUILT_IN_BLACKLIST end end
compatible_file_cache()
click to toggle source
兼容文件缓存
# File lib/web_sandbox_console/safe_ruby.rb, line 118 def compatible_file_cache ActiveSupport::Cache::FileStore.class_exec do def write_entry(key, entry, options) true end def delete_entry(key, options) true end end end
compatible_i18n_translate()
click to toggle source
兼容翻译
# File lib/web_sandbox_console/safe_ruby.rb, line 131 def compatible_i18n_translate I18n.instance_exec do def translate(*args) "ActiveRecord::RecordInvalid: 校验失败" end alias :t :translate end end
delete_entry(key, options)
click to toggle source
# File lib/web_sandbox_console/safe_ruby.rb, line 124 def delete_entry(key, options) true end
flatten_arr(arr)
click to toggle source
发现此处method_missing Array 没有flatten方法
# File lib/web_sandbox_console/safe_ruby.rb, line 144 def flatten_arr(arr) new_arr = [] arr.each do |e| if e.is_a?(Array) new_arr.concat(flatten_arr(e)) else new_arr << e end end new_arr end
init_safe_env()
click to toggle source
初始化安全环境
# File lib/web_sandbox_console/safe_ruby.rb, line 4 def init_safe_env sanitize_constants sanitize_instance_methods sanitize_class_methods sanitize_logger_new sanitize_csv compatible_file_cache compatible_i18n_translate blacklist_method_remind end
instance_method_blacklists()
click to toggle source
实例方法黑名单列表
# File lib/web_sandbox_console/safe_ruby.rb, line 47 def instance_method_blacklists blacklist = if instance_method_blacklist merge_method_hash(INSTANT_METOD_BUILT_IN_BLACKLIST,instance_method_blacklist) else INSTANT_METOD_BUILT_IN_BLACKLIST end end
merge_method_hash(hash1, hash2)
click to toggle source
将两个hash 内部数组也同时合并,并去重
# File lib/web_sandbox_console/safe_ruby.rb, line 64 def merge_method_hash(hash1, hash2) # 格式统一 hash2.transform_keys!(&:to_sym).transform_keys!(&:to_sym).transform_values!{|i| i.map(&:to_sym)} # 共有的key common_keys = hash2.keys & hash1.keys # hash2 特有keys hash2_special_keys = hash2.keys - hash1.keys # 特有keys 直接合到 hash1 hash1.merge!(hash2.slice(*hash2_special_keys)) # 共用keys 数组去重 common_keys.each do |key| hash1[key] = (hash1[key] | hash2[key]).uniq end hash1 end
method_missing(name,*params)
click to toggle source
Calls superclass method
# File lib/web_sandbox_console/safe_ruby.rb, line 156 def method_missing(name,*params) class_methods = WebSandboxConsole.class_method_blacklists.values instance_methods = WebSandboxConsole.instance_method_blacklists.values if flatten_arr([class_methods, instance_methods]).include?(name.to_sym) msg = "PS:当前代码执行过程中可能调用了黑名单方法,若代码正常返回,请忽略此条提醒" WebSandboxConsole.log_p(msg, true) end super end
new(logdev, shift_age = 0, shift_size = 1048576)
click to toggle source
# File lib/web_sandbox_console/safe_ruby.rb, line 84 def new(logdev, shift_age = 0, shift_size = 1048576) instance = allocate instance.send(:initialize, logdev.to_s, shift_age, shift_size) instance end
open(filename, mode="r", **options) { |logger| ... }
click to toggle source
重写方法 以写日志方式 写数据
# File lib/web_sandbox_console/safe_ruby.rb, line 98 def open(filename, mode="r", **options) # 无论输入什么路径 都只会在log下创建文件 basename = File.basename(filename, ".*") file_path = "#{Rails.root}/log/#{basename}.csv" logger = Logger.new(file_path) logger.formatter = proc {|severity, datetime, progname, msg| msg} logger.instance_exec do # 支持类型 csv 数据写入方式 def << (data_arr) self.info data_arr.join(",") + "\n" end end yield(logger) end
sanitize_class_methods()
click to toggle source
净化 类方法
# File lib/web_sandbox_console/safe_ruby.rb, line 16 def sanitize_class_methods class_method_blacklists.each do |klass, methods| klass = Object.const_get(klass) methods.each do |method| next if klass.singleton_methods.exclude?(method) klass.singleton_class.send(:undef_method, method) end end end
sanitize_constants()
click to toggle source
净化 常量
# File lib/web_sandbox_console/safe_ruby.rb, line 56 def sanitize_constants return unless constant_blacklist constant_blacklist.each do |const| Object.send(:remove_const, const) if defined?(const) end end
sanitize_csv()
click to toggle source
净化 csv
# File lib/web_sandbox_console/safe_ruby.rb, line 93 def sanitize_csv require 'csv' unless defined? CSV CSV.instance_eval do # 重写方法 以写日志方式 写数据 def open(filename, mode="r", **options) # 无论输入什么路径 都只会在log下创建文件 basename = File.basename(filename, ".*") file_path = "#{Rails.root}/log/#{basename}.csv" logger = Logger.new(file_path) logger.formatter = proc {|severity, datetime, progname, msg| msg} logger.instance_exec do # 支持类型 csv 数据写入方式 def << (data_arr) self.info data_arr.join(",") + "\n" end end yield(logger) end end end
sanitize_instance_methods()
click to toggle source
净化 实例方法
# File lib/web_sandbox_console/safe_ruby.rb, line 27 def sanitize_instance_methods instance_method_blacklists.each do |klass, methods| klass = Object.const_get(klass) methods.each do |method| next if (klass != Kernel) && klass.instance_methods.exclude?(method) klass.send(:undef_method, method) end end end
sanitize_logger_new()
click to toggle source
发现代码 中有 Logger.new(Rails.root.join('log', 'hubar')) 写法, 会 触发 File.open方法 封装后避免调用 File.open(禁用)
# File lib/web_sandbox_console/safe_ruby.rb, line 82 def sanitize_logger_new Logger.instance_eval do def new(logdev, shift_age = 0, shift_size = 1048576) instance = allocate instance.send(:initialize, logdev.to_s, shift_age, shift_size) instance end end end
translate(*args)
click to toggle source
# File lib/web_sandbox_console/safe_ruby.rb, line 133 def translate(*args) "ActiveRecord::RecordInvalid: 校验失败" end
write_entry(key, entry, options)
click to toggle source
# File lib/web_sandbox_console/safe_ruby.rb, line 120 def write_entry(key, entry, options) true end