rails/rails — pull request #5666 by plashchynski (2012-03-30 09:45:34+00:00)
Title: class and module attribute accessor refactoring

class and module accessors are not safe for an user input.
Here an example:

1.9.2p318 :001 > class HoleyClass; end
=> nil
1.9.2p318 :002 > HoleyClass.cattr_writer("abc; `echo 1 > ~/1`; @@some_var")
=> ["abc; `echo 1 > ~/1`; @@some_var"]
1.9.2p318 :003 > HoleyClass.cattr_reader("abc; `echo 2 > ~/2`; @@some_var")
=> ["abc; `echo 2 > ~/2`; @@some_var"]
1.9.2p318 :004 > HoleyClass.cattr_accessor("abc; `echo 3 > ~/3`; @@some_var")
=> ["abc; `echo 3 > ~/3`; @@some_var"]
1.9.2p318 :005 > HoleyClass.send(:attr_accessor, "abc; `echo 3 > ~/3`; @@some_var") # attr_accessor is safe
NameError: invalid attribute name `abc; `echo 3 > ~/3`; @@some_var'

Of course this is not a dangerous vulnerability. I hope no one passes an user input to these methods.
But if it is possible to make them safer, so why not?