How can I program protection in Ruby?

Question

Here's a great example of a problem: Classifier graphics break Rails .

** Original Question: **

One thing that concerns me as a security professional is that Ruby has no parallel to the privacy of the Java package. That is, this is not valid Ruby:

public module Foo
  public module Bar
    # factory method for new Bar implementations
    def self.new(...)
      SimpleBarImplementation.new(...)
    end
    def baz
      raise NotImplementedError.new('Implementing Classes MUST redefine #baz')
    end
  end

  private class SimpleBarImplementation
    include Bar
    def baz
      ...
    end
  end
end

, Foo:: BarImpl. , , , , . , - MD5 SHA1 ! freeze , " ", , , .

Java , Ruby. (. .) ? Ruby " " ?

( , Ruby. . :)

require 'md5'
# => true
MD5.frozen?
# => false

Answer 1

Immutable .

.

Answer 2

, .

, "-" MD5 - . . , Java , , - MD5. .

: , :

require 'awesome'
# Do something awesome.

, - :

require 'evil_cracker_lib_from_russian_pr0n_site'
# Overrides crypto functions and sends all data to mafia
require 'awesome'
# Now everything is insecure because awesome lib uses 
# cracker lib instead of builtin

: ! , , . , , , .

Java: , Java private final, . , - ! , - : Java OpenSSL . , , , , Debian , OpenSSL . , Java-, Debian , !

Answer 3

Java

, , , ( ) .
, .

, , " ".

-, , , , dll injection .

, . .

, , ruby ​​- . Monkeypatching , .

Answer 4

, Ruby , , . .
. Ruby String, .

Answer 5

" " , , Google Amazon. , .

, , , , , , . ? , . , . . , .

:

require 'evil_cracker_lib_from_russian_pr0n_site'
require 'awesome'

awesome, foobar fazbot, foobar, has_gumption, ... , .

" " - . ; . .

Answer 6

- , Immutable ( ).

Answer 7

, Lucky Stiff "", , . http://code.whytheluckystiff.net/sandbox/

( TicTacToe): http://www.elctech.com/blog/safely-exposing-your-app-to-a-ruby-sandbox

Answer 8

Raganwald . :

class Module
  def anonymous_module(&block)
   self.send :include, Module.new(&block)
  end
end

class Acronym
  anonymous_module do
    fu = lambda { 'fu' }
    bar = lambda { 'bar' }
    define_method :fubar do
      fu.call + bar.call
    end
  end
end

fubar Acronym s, (fu bar) .

Answer 9

- , 2 : . , ( ), . , , .

, , . - - ? , monkeypatch - , .

, , . - .