Class: Marshalsea::Chains::ErbDefMethod

Inherits:
Base
  • Object
show all
Defined in:
lib/marshalsea/chains/erb_def_method.rb

Constant Summary collapse

CHAIN_NAME = 
"erb-def-method"
VECTOR = 
"def_method"
CVE = 
"CVE-2026-41316"
TARGET_GEM = 
"erb"
AFFECTED = 
[
  ["< 4.0.3.1"],
  ["= 4.0.4"],
  [">= 5.0.0", "< 6.0.1.1"],
  [">= 6.0.2", "< 6.0.4"]
].map { |constraints| constraints.map(&:freeze).freeze }.freeze
SRC_PREFIX = 
"#\nend\n"
SRC_SUFFIX = 
"\ndef _marshalsea_unused\n"
DEFAULT_FILENAME = 
"(erb)"
DEFAULT_LINENO = 
0
IVAR_SRC = 
:@src
IVAR_FILENAME = 
:@filename
IVAR_LINENO = 
:@lineno
CANARY_TEMPLATE = 
"File.write(%<path>p, %<marker>p)"
METADATA = 
{
  name: CHAIN_NAME,
  vector: VECTOR,
  cve: CVE,
  gem: TARGET_GEM,
  affected: AFFECTED,
  kind: KIND_PRIMITIVE
}.freeze

Constants inherited from Base

Base::HASH_WITH_ONE_ENTRY, Base::HEADER_BYTES, Base::KIND_CHAIN, Base::KIND_PRIMITIVE, Base::NIL_VALUE, Base::OBJECT_LINK_REFUSED, Base::SUBCLASS_MUST_DEFINE

Class Method Summary collapse

Instance Method Summary collapse

Methods inherited from Base

affected_requirements, affects?, chain?, chain_name, cve, inherited, kind, primitive?, required_gems, #serialize, target_gem, vector

Constructor Details

#initialize(ruby_source) ⇒ ErbDefMethod

Returns a new instance of ErbDefMethod.



50
51
52
53
 
# File 'lib/marshalsea/chains/erb_def_method.rb', line 50

def initialize(ruby_source)
  super()
  @ruby_source = ruby_source
end

Class Method Details

.canary(path, marker) ⇒ Object 



46
47
48
 
# File 'lib/marshalsea/chains/erb_def_method.rb', line 46

def self.canary(path, marker)
  new(format(CANARY_TEMPLATE, path: path, marker: marker))
end

.metadata ⇒ Object 



42
43
44
 
# File 'lib/marshalsea/chains/erb_def_method.rb', line 42

def self.metadata
  METADATA
end

Instance Method Details

#generate ⇒ Object 



55
56
57
58
59
60
61
 
# File 'lib/marshalsea/chains/erb_def_method.rb', line 55

def generate
  object = ERB.allocate
  object.instance_variable_set(IVAR_SRC, src)
  object.instance_variable_set(IVAR_FILENAME, DEFAULT_FILENAME)
  object.instance_variable_set(IVAR_LINENO, DEFAULT_LINENO)
  object
end

#src ⇒ Object 



63
64
65
 
# File 'lib/marshalsea/chains/erb_def_method.rb', line 63

def src
  "#{SRC_PREFIX}#{@ruby_source}#{SRC_SUFFIX}"
end