From 352b6ef7a5d9ed7c979d3f2996e05e9af57e7283 Mon Sep 17 00:00:00 2001 From: "wade@bindshell.net" Date: Fri, 30 Sep 2011 13:18:08 +0000 Subject: [PATCH] insecure eval funtion has been overloaded git-svn-id: https://beef.googlecode.com/svn/trunk@1330 b87d56ec-f9c0-11de-8c8a-61c5e9addfc9 --- core/ruby.rb | 2 ++ core/ruby/security.rb | 21 +++++++++++++++++++++ 2 files changed, 23 insertions(+) create mode 100644 core/ruby/security.rb diff --git a/core/ruby.rb b/core/ruby.rb index f04f14978..6b2b175ae 100644 --- a/core/ruby.rb +++ b/core/ruby.rb @@ -14,6 +14,8 @@ # limitations under the License. # +# @note Patching Ruby Security +require 'core/ruby/security' # @note Patching Ruby require 'core/ruby/module' diff --git a/core/ruby/security.rb b/core/ruby/security.rb new file mode 100644 index 000000000..7792048a9 --- /dev/null +++ b/core/ruby/security.rb @@ -0,0 +1,21 @@ +# +# Copyright 2011 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# @note Prevent eval from ever being used +def eval(args) + puts "For security reasons the eval method is not accepted in the Browser Exploitation Framework code base." + exit +end