DATA.seek allows to read file

Discussion in 'Ruby' started by Robert Klemme, Jan 11, 2011.

  1. Hi,

    I just noticed this:

    09:57:58 ~$ allruby /c/Temp/d.rb
    CYGWIN_NT-5.1 padrklemme2 1.7.7(0.230/5/3) 2010-08-31 09:58 i686 Cygwin
    ========================================
    ruby 1.8.7 (2008-08-11 patchlevel 72) [i386-cygwin]
    "line 1\nline 2\n"
    "\np DATA.read\nDATA.seek 0\np DATA.read\n\n__END__\nline 1\nline 2\n"
    ========================================
    ruby 1.9.2p136 (2010-12-25 revision 30365) [i386-cygwin]
    "line 1\nline 2\n"
    "\np DATA.read\nDATA.seek 0\np DATA.read\n\n__END__\nline 1\nline 2\n"
    ========================================
    jruby 1.4.0 (ruby 1.8.7 patchlevel 174) (2009-11-02 69fbfa3) (Java
    HotSpot(TM) Client VM 1.6.0_23) [x86-java]
    "line 1\nline 2\n"
    ""
    09:58:31 ~$ cat /c/Temp/d.rb

    p DATA.read
    DATA.seek 0
    p DATA.read

    __END__
    line 1
    line 2
    09:58:37 ~$

    In other words, I can read what's before __END__ if I simply seek.
    IMHO that is a bad thing and may even be used for attacks.

    Btw, I stumbled across this by doing this:

    10:01:24 ~$ ruby19 /c/Temp/dd.rb
    ["require 'csv'"]
    []
    ["CSV.foreach DATA do |rec|"]
    [" p rec"]
    ["end"]
    []
    ["__END__"]
    ["line 1"]
    ["line 2"]
    10:01:33 ~$ cat /c/Temp/dd.rb
    require 'csv'

    CSV.foreach DATA do |rec|
    p rec
    end

    __END__
    line 1
    line 2
    10:01:37 ~$

    Maybe it's not such a good idea for CSV.foreach to seek to 0 before
    starting to read. As a user of CSV I would always want it to start
    off where the IO currently points to. James, what do you think?

    Kind regards

    robert

    --
    remember.guy do |as, often| as.you_can - without end
    http://blog.rubybestpractices.com/
     
    Robert Klemme, Jan 11, 2011
    #1
    1. Advertising

  2. On 11 Jan 2011, at 09:03, Robert Klemme wrote:

    > In other words, I can read what's before __END__ if I simply seek.
    > IMHO that is a bad thing and may even be used for attacks.



    I've written a script in the past that (ab)used that to use DATA as a =
    small datastore, rather than writing out to a separate data file. I had =
    to write out the entire file though, including the source code, so being =
    able to just seek back to 0 and read from there was helpful for writing =
    the script.

    C
    ---
    Caius Durling

    +44 (0) 7960 268 100
    http://caius.name/
     
    Caius Durling, Jan 11, 2011
    #2
    1. Advertising

  3. On Jan 11, 2011, at 4:55 AM, Caius Durling wrote:

    > On 11 Jan 2011, at 09:03, Robert Klemme wrote:
    >=20
    >> In other words, I can read what's before __END__ if I simply seek.
    >> IMHO that is a bad thing and may even be used for attacks.


    I love the feature. It's one of those fun things to abuse. :)

    > I've written a script in the past that (ab)used that to use DATA as a =

    small datastore=85

    I've done that too. :)

    > rather than writing out to a separate data file. I had to write out =

    the entire file though, including the source code=85

    You don't have to rewrite the code, if you are careful:

    #!/usr/bin/env ruby -wKU

    pos =3D DATA.pos # memorize position after __END__

    # do whatever
    count =3D DATA.read.to_i
    puts "Count: #{count}"
    count +=3D 1

    DATA.reopen(__FILE__, "a+") # turn on writing mode
    DATA.truncate(pos) # remove the DATA section
    DATA.puts count # update DATA

    __END__
    0

    James Edward Gray II
     
    James Edward Gray II, Jan 11, 2011
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Eidolon

    Application.Lock - allows read??

    Eidolon, Aug 15, 2003, in forum: ASP .Net
    Replies:
    4
    Views:
    530
    S. Justin Gengo
    Aug 16, 2003
  2. Amy G

    Using .seek(0) to read.

    Amy G, Jan 10, 2004, in forum: Python
    Replies:
    1
    Views:
    335
    Tim Roberts
    Jan 12, 2004
  3. Prateek
    Replies:
    2
    Views:
    281
    Prateek
    Apr 30, 2007
  4. Martin Durai
    Replies:
    11
    Views:
    331
    James Edward Gray II
    Nov 26, 2007
  5. Replies:
    3
    Views:
    134
    Andreas Perstinger
    May 14, 2013
Loading...

Share This Page