Class: SandboxedErb::TreeProcessor

Inherits:
SexpProcessor
  • Object
show all
Defined in:
lib/sandboxed_erb/tree_processor.rb

Overview

:nodoc: all

Instance Method Summary collapse

Constructor Details

#initialize ⇒ TreeProcessor

Returns a new instance of TreeProcessor.



29
30
31
32
33
34
35
36
37
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 29

def initialize
  super()
  self.default_method = :fallback_process
  self.require_empty = false
  self.warn_on_default = false
  
  @hook_handler_name = "@_hook_handler".intern
  @last_line_number = 0
end

Instance Method Details

#fallback_process(tree) ⇒ Object

Raises:



146
147
148
149
150
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 146

def fallback_process(tree)
  puts tree.inspect if $DEBUG
  puts "Fallback called" if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: Invalid call used: #{tree[0]}"
end

#process_attrasgn(tree) ⇒ Object

we treat this same as a call



40
41
42
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 40

def process_attrasgn(tree)
  process_call(tree)
end

#process_call(tree) ⇒ Object 



44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 44

def process_call(tree)
  puts tree.inspect if $DEBUG
  if [:_sbm].include?(tree[2]) 
    raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: #{tree[2].to_s} is a reserved method"
  elsif tree[1] && tree[1][0] == :lvar && tree[1][1] == :_erbout && tree[2] == :concat #optimisation:call concat on _erbout is safe... dont need to route through _sbm
    add_line_number(tree, s(tree[0], tree[1], tree[2], process(tree[3])))
  elsif tree[1] && tree[2] == :to_s && tree[3][0] == :arglist && tree[3].length == 1 #optimisation:call to_s on an object is safe... dont need to route through _sbm
    add_line_number(tree, s(tree[0], process(tree[1]), tree[2], tree[3]))
  elsif tree[1] 
    #rewrite obj.call(arg1, arg2, argN) to obj._invoke_sbm(:call, arg1, arg2, argN)
    args = [:arglist]
    args << s(:lit, tree[2])
    args << s(:ivar, "@_sb_context".intern)
    for i in 1...tree[3].length
      args << process(tree[3][i])
    end
    add_line_number(tree, s(:call, process(tree[1]), :_sbm, args))
  else
    #call on mixed in method or passed in variable 
    receiver = s(:self)
    #rewrite local_call(arg1, arg2, argN) to self._get_local(:local_call, arg1, arg2, argN)
    args = [:arglist]
    args << s(:lit, tree[2])
    for i in 1...tree[3].length
      args << tree[3][i]
    end
    add_line_number(tree, s(:call, s(:self), :_get_local, process(args)))
  end
end

#process_cdecl(tree) ⇒ Object

Raises:



96
97
98
99
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 96

def process_cdecl(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot define a constant in a template"
end

#process_class(tree) ⇒ Object

Raises:



106
107
108
109
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 106

def process_class(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot define a class in a template"
end

#process_const(tree) ⇒ Object

Raises:



101
102
103
104
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 101

def process_const(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot access a constant in a template"
end

#process_cvasgn(tree) ⇒ Object

Raises:



86
87
88
89
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 86

def process_cvasgn(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot assign class members in a template"
end

#process_cvdecl(tree) ⇒ Object

Raises:



91
92
93
94
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 91

def process_cvdecl(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot declare class members in a template"
end

#process_defn(tree) ⇒ Object

Raises:



116
117
118
119
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 116

def process_defn(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot define a method in a template"
end

#process_defs(tree) ⇒ Object

Raises:



121
122
123
124
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 121

def process_defs(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot define a method in a template"
end

#process_gasgn(tree) ⇒ Object

Raises:



136
137
138
139
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 136

def process_gasgn(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot assign global variables in a template"
end

#process_gvar(tree) ⇒ Object

Raises:



131
132
133
134
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 131

def process_gvar(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot access global variables in a template"
end

#process_iasgn(tree) ⇒ Object

disallowed

Raises:



76
77
78
79
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 76

def process_iasgn(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot assign instance members in a template"
end

#process_ivar(tree) ⇒ Object

Raises:



81
82
83
84
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 81

def process_ivar(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot access instance members in a template"
end

#process_module(tree) ⇒ Object

Raises:



111
112
113
114
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 111

def process_module(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot define a module in a template"
end

#process_super(tree) ⇒ Object

Raises:



126
127
128
129
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 126

def process_super(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot call super in a template"
end

#process_xstr(tree) ⇒ Object

Raises:



141
142
143
144
 
# File 'lib/sandboxed_erb/tree_processor.rb', line 141

def process_xstr(tree)
  puts tree.inspect if $DEBUG
  raise SandboxedErb::CompileSecurityError, "Line #{tree.line}: You cannot make a system call in a template"
end