CVE-2016-3693: Permissions, Privileges, and Access Controls (CWE-264)
value: The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CVSS v3 base score: 8.1
Published: 2016-05-20T14:59Z
Repository: https://github.com/svenfuchs/safemode
Language: Ruby
Files changed: lib/safemode/blankslate.rb, test/test_jail.rb
Commit date: 2016-04-14 14:03:10 +0100
Commit message: Remove `inspect` from allowed methods

The `inspect` method is pretty unsafe, as by default it includes
a lot of data from the object.

Diff: diff --git a/lib/safemode/blankslate.rb b/lib/safemode/blankslate.rb
index 39d0fa1..88a8340 100644
--- a/lib/safemode/blankslate.rb
+++ b/lib/safemode/blankslate.rb
@@ -1,9 +1,9 @@
 module Safemode
   class Blankslate
-    @@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
-    @@allow_class_methods    = ['methods', 'new', 'name', 'inspect', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
+    @@allow_instance_methods = ['class', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
+    @@allow_class_methods    = ['methods', 'new', 'name', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
 
     silently { undef_methods(*instance_methods.map(&:to_s) - @@allow_instance_methods) }
     class << self
       silently { undef_methods(*instance_methods.map(&:to_s) - @@allow_class_methods) }
 
diff --git a/test/test_jail.rb b/test/test_jail.rb
index 57e324a..42ce3ef 100644
--- a/test/test_jail.rb
+++ b/test/test_jail.rb
@@ -17,19 +17,19 @@ class TestJail < Test::Unit::TestCase
   def test_sending_to_jail_to_an_object_should_return_a_jail
     assert_equal "Article::Jail", @article.class.name
   end
 
   def test_jail_instances_should_have_limited_methods
-    expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
+    expected = ["class", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
     expected.delete('respond_to_missing?') if RUBY_VERSION > '1.9.3' # respond_to_missing? is private in rubies above 1.9.3
     objects.each do |object|
       assert_equal expected.sort, reject_pretty_methods(object.to_jail.methods.map(&:to_s).sort)
     end
   end
 
   def test_jail_classes_should_have_limited_methods
-    expected = ["new", "methods", "name", "inherited", "method_added", "inspect",
+    expected = ["new", "methods", "name", "inherited", "method_added",
                 "allow", "allowed?", "allowed_methods", "init_allowed_methods",
                 "<", # < needed in Rails Object#subclasses_of
                 "ancestors", "==" # ancestors and == needed in Rails::Generator::Spec#lookup_class
                ]
     objects.each do |object|

Vulnerable code:     @@allow_instance_methods = ['class', 'inspect', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
    @@allow_class_methods    = ['methods', 'new', 'name', 'inspect', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
    expected = ["class", "inspect", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
    expected = ["new", "methods", "name", "inherited", "method_added", "inspect",
Fixed code:     @@allow_instance_methods = ['class', 'methods', 'respond_to?', 'respond_to_missing?', 'to_s', 'instance_variable_get']
    @@allow_class_methods    = ['methods', 'new', 'name', '<', 'ancestors', '=='] # < needed in Rails Object#subclasses_of
    expected = ["class", "method_missing", "methods", "respond_to?", "respond_to_missing?", "to_jail", "to_s", "instance_variable_get"]
    expected = ["new", "methods", "name", "inherited", "method_added",