jwo/jruby-sandbox — pull request #1 by whitehat101 (2013-12-04 05:34:55+00:00)
Title: Lockdown Ref'd Object Eval and fix getStdOut's return runtime

You were able to call eval on ref'd objects because of the way method_missing was implemented.

I believe in java's SandboxFull#runMethod:

```java
IRubyObject result = recv2.callMethod(getRuntime().getCurrentContext(), name, args2, block);
```

#callMethod is more like `send`. *I'm not 100% sure because of sparse documentation.*

My patch raises a `SecurityError` whenever `method_missing` is called with a method name of `eval`. E.g.:

```
SecurityError: eval not allowed on File
```

If you were to define a regular `eval` method in `BoxedClass`, a hacker would still be able to use `method_missing` directly to access the external object's `eval` (e.g.: `File.method_missing :eval, 'File'`). Patching the hole in `method_missing` is a better fix.

---

In your ruby-fiddle-exec, I noticed that you wrapped the sandbox output in `String.new`. After investigating, I found that `getStdOut` was returning a sandbox string instead of a top-level ruby string, which is why it was having to be re-wrapped.