square/shuttle — pull request #71 by RISCfuture (2014-03-07 05:56:30+00:00)
Title: [DO NOT MERGE] Ruby 2.1.1

@RickCSong

Ruby 2.1.1 support. Do not merge until we're ready to go server-side. Changes:

* Removal of `$SAFE=4`
* Tweaked YAML output syntax

### Removal of `$SAFE=4`

Ruby 2.1.1 removes `$SAFE=4` because it was being used (including by us) as a poor man's sandbox. Most people have upgraded to 2.1.1 by downgrading their code to `$SAFE=3`, but this of course defeats the whole purpose (and the sheer number of people who have done this is frankly scary).

Instead, I've created a real sandbox by starting a Ruby subprocess, executing the code, and outputting the result as YAML. This is not the same as the former `$SAFE=4` approach, and has important upsides and downsides.

Upsides:

* Ruby code is executed in a completely isolated memory environment. Ruby code cannot access or modify Shuttle data, or patch Shuttle classes.
* Shuttle's own gems and monkey-patches do not contaminate the execution environment for the Ruby parser.

Downsides:

* File system access is in no way restricted. (This is a big issue. For now I've been making the distinction between untrusted code and malicious code, and writing only for the former. Any security expert will of course tell you there is no difference between the two, but it's worth pointing out that this code is never from user input, only from our internal code base.)
* We could fix this by executing the Ruby process as an unprivileged user in a chrooted directory. Wondering if this is overkill.
* Starting a new process instead of evaluating Ruby code inline can have potentially significant speed implications.