jruby · Apr 1, 2016 · Apr 1, 2016 · Apr 2, 2016 · Apr 2, 2016 · Apr 2, 2016
diff --git a/core/src/main/java/org/jruby/util/cli/Options.java b/core/src/main/java/org/jruby/util/cli/Options.java
@@ -222,11 +222,16 @@ public class Options {
     public static final Option<Boolean> CLI_STRIP_HEADER = bool(CLI, "cli.strip.header", false, "Strip text before shebang in script. Same as -x.");
     public static final Option<Boolean> CLI_LOAD_GEMFILE = bool(CLI, "cli.load.gemfile", false, "Load a bundler Gemfile in cwd before running. Same as -G.");
 
+    public static final Option<Boolean> TRUFFLE_PLATFORM_SAFE = bool(TRUFFLE, "truffle.platform.safe", false, "Disallow any unsafe access to the platform, such as IO, processes and so on.");
+    public static final Option<Boolean> TRUFFLE_PLATFORM_SAFE_PROCESSES = bool(TRUFFLE, "truffle.platform.safe.processes", false, "Treat any methods that deal with processes as safe.");
+    public static final Option<Boolean> TRUFFLE_PLATFORM_SAFE_EXIT = bool(TRUFFLE, "truffle.platform.safe.exit", false, "Treat exiting the VM as safe.");
+    public static final Option<Boolean> TRUFFLE_PLATFORM_SAFE_PUTS = bool(TRUFFLE, "truffle.platform.safe_puts", true, "Treat Truffle::Primitive.safe_puts as safe.");
+    public static final Option<Boolean> TRUFFLE_PLATFORM_USE_JAVA = bool(TRUFFLE, "truffle.platform.use_java", false, "Use a pure-Java platform, so no native POSIX.");
+
     public static final Option<Boolean> TRUFFLE_COVERAGE = bool(TRUFFLE, "truffle.coverage", false, "Enable coverage (will be enabled by default in the future - currently has some bugs).");
     public static final Option<Boolean> TRUFFLE_COVERAGE_GLOBAL = bool(TRUFFLE, "truffle.coverage.global", false, "Run coverage for all code and print results on exit.");
 
     public static final Option<String> TRUFFLE_CORE_LOAD_PATH = string(TRUFFLE, "truffle.core.load_path", "truffle:/jruby-truffle", "Location to load the Truffle core library from.");
-    public static final Option<Boolean> TRUFFLE_PLATFORM_USE_JAVA = bool(TRUFFLE, "truffle.platform.use_java", false, "Use a pure-Java platform, so no native POSIX.");
 
     public static final Option<Integer> TRUFFLE_ARRAY_UNINITIALIZED_SIZE = integer(TRUFFLE, "truffle.array.uninitialized_size", 32, "How large an Array to allocate when we have no other information to go on.");
     public static final Option<Integer> TRUFFLE_ARRAY_SMALL = integer(TRUFFLE, "truffle.array.small", 3, "Maximum size of an Array to consider small for optimisations.");

diff --git a/test/truffle/integration/safe.sh b/test/truffle/integration/safe.sh
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+function run {
+  ruby -X+T -Xtruffle.platform.safe=true "$@"
+}
+
+function safe {
+  run "$@" || ( echo "$@" was not safe ; exit 1 )
+}
+
+function unsafe {
+  run "$@" && ( echo "$@" was not unsafe ; exit 1 )
+}
+
+# Things that are alway safe
+
+safe -e "14"
+
+# Check our safe_puts is safe
+
+safe -e "Truffle::Primitive.safe_puts 'hello, world'"
+
+# But we can make that unsafe as well if really don't want any output
+
+unsafe -Xtruffle.platform.safe_puts=false -e "Truffle::Primitive.safe_puts 'hello, world'"
+
+# Check default unsafe operations
+
+#unsafe -e "puts 'hello, world'"
+unsafe -e '`echo foo`'
+unsafe -e 'exit'
+unsafe -e 'exit!'
+
+# Check we can enable some unsafe operations if we want to
+
+safe -Xtruffle.platform.safe.processes=true -e '`echo foo`'
+safe -Xtruffle.platform.safe.exit=true -e 'exit'
+
+# Check that safe_puts sanitises correctly
+
+if [[ `run -e "Truffle::Primitive.safe_puts 'foo © bar'"` != 'foo ? bar' ]]
+then
+  echo safe_puts is not sanitising output
+  exit 1
+fi
diff --git a/truffle/src/main/java/org/jruby/truffle/core/CoreLibrary.java b/truffle/src/main/java/org/jruby/truffle/core/CoreLibrary.java
@@ -1372,6 +1372,10 @@ public DynamicObject rangeError(String message, Node currentNode) {
         return ExceptionNodes.createRubyException(rangeErrorClass, StringOperations.createString(context, StringOperations.encodeRope(message, UTF8Encoding.INSTANCE)), context.getCallStack().getBacktrace(currentNode));
     }
 
+    public DynamicObject internalErrorUnsafe(Node currentNode) {
+        return internalError("unsafe operation", currentNode, null);
+    }
+
     public DynamicObject internalError(String message, Node currentNode) {
         return internalError(message, currentNode, null);
     }

diff --git a/truffle/src/main/java/org/jruby/truffle/core/CoreMethod.java b/truffle/src/main/java/org/jruby/truffle/core/CoreMethod.java
@@ -11,6 +11,7 @@
 
 import org.jruby.runtime.Visibility;
 import org.jruby.truffle.language.methods.UnsupportedOperationBehavior;
+import org.jruby.truffle.platform.UnsafeGroup;
 
 import java.lang.annotation.ElementType;
 import java.lang.annotation.Retention;
@@ -81,4 +82,8 @@
 
     boolean returnsEnumeratorIfNoBlock() default false;
 
+    UnsafeGroup[] unsafe() default {};
+
+    boolean unsafeNeedsAudit() default false;
+
 }
diff --git a/truffle/src/main/java/org/jruby/truffle/core/CoreMethodNodeManager.java b/truffle/src/main/java/org/jruby/truffle/core/CoreMethodNodeManager.java
@@ -24,6 +24,7 @@
 import org.jruby.truffle.core.numeric.FixnumLowerNodeGen;
 import org.jruby.truffle.language.LexicalScope;
 import org.jruby.truffle.language.NotProvided;
+import org.jruby.truffle.language.Options;
 import org.jruby.truffle.language.RubyConstant;
 import org.jruby.truffle.language.RubyGuards;
 import org.jruby.truffle.language.RubyNode;
@@ -40,6 +41,7 @@
 import org.jruby.truffle.language.objects.SelfNode;
 import org.jruby.truffle.language.objects.SingletonClassNode;
 import org.jruby.truffle.language.parser.jruby.Translator;
+import org.jruby.truffle.platform.UnsafeGroup;
 
 import java.lang.reflect.Method;
 import java.util.ArrayList;
@@ -231,24 +233,59 @@ private static RubyRootNode makeGenericMethod(RubyContext context, MethodDetails
         }
 
         final RubyNode checkArity = Translator.createCheckArityNode(context, sourceSection, arity);
-        RubyNode sequence = Translator.sequence(context, sourceSection, Arrays.asList(checkArity, methodNode));
 
-        if (method.returnsEnumeratorIfNoBlock()) {
-            // TODO BF 3-18-2015 Handle multiple method names correctly
-            sequence = new ReturnEnumeratorIfNoBlockNode(method.names()[0], sequence);
-        }
+        RubyNode sequence;
+
+        if (context.getOptions().PLATFORM_SAFE && !isSafe(context, method.unsafe())) {
+            sequence = new UnsafeNode(context, sourceSection);
+        } else {
+            sequence = Translator.sequence(context, sourceSection, Arrays.asList(checkArity, methodNode));
 
-        if (method.taintFromSelf() || method.taintFromParameter() != -1) {
-            sequence = new TaintResultNode(method.taintFromSelf(),
-                                           method.taintFromParameter(),
-                                           sequence);
+            if (method.returnsEnumeratorIfNoBlock()) {
+                // TODO BF 3-18-2015 Handle multiple method names correctly
+                sequence = new ReturnEnumeratorIfNoBlockNode(method.names()[0], sequence);
+            }
+
+            if (method.taintFromSelf() || method.taintFromParameter() != -1) {
+                sequence = new TaintResultNode(method.taintFromSelf(),
+                        method.taintFromParameter(),
+                        sequence);
+            }
         }
 
         final ExceptionTranslatingNode exceptionTranslatingNode = new ExceptionTranslatingNode(context, sourceSection, sequence, method.unsupportedOperationBehavior());
 
         return new RubyRootNode(context, sourceSection, null, sharedMethodInfo, exceptionTranslatingNode, false);
     }
 
+    public static boolean isSafe(RubyContext context, UnsafeGroup[] groups) {
+        final Options options = context.getOptions();
+
+        for (UnsafeGroup group : groups) {
+            final boolean option;
+
+            switch (group) {
+                case PROCESSES:
+                    option = options.PLATFORM_SAFE_PROCESSES;
+                    break;
+                case EXIT:
+                    option = options.PLATFORM_SAFE_EXIT;
+                    break;
+                case SAFE_PUTS:
+                    option = options.PLATFORM_SAFE_PUTS;
+                    break;
+                default:
+                    throw new IllegalStateException();
+            }
+
+            if (!option) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
     public void allMethodInstalled() {
         if (System.getenv("TRUFFLE_CHECK_AMBIGUOUS_OPTIONAL_ARGS") != null &&
             !AmbiguousOptionalArgumentChecker.SUCCESS) {

diff --git a/truffle/src/main/java/org/jruby/truffle/core/MainNodes.java b/truffle/src/main/java/org/jruby/truffle/core/MainNodes.java
@@ -22,7 +22,7 @@
 @CoreClass(name = "main")
 public abstract class MainNodes {
 
-    @CoreMethod(names = "public", rest = true, needsSelf = false, visibility = Visibility.PRIVATE)
+    @CoreMethod(unsafeNeedsAudit = true, names = "public", rest = true, needsSelf = false, visibility = Visibility.PRIVATE)
     public abstract static class PublicNode extends CoreMethodArrayArgumentsNode {
 
         @Child private ModuleNodes.PublicNode publicNode;
@@ -39,7 +39,7 @@ public DynamicObject doPublic(VirtualFrame frame, Object[] args) {
         }
     }
 
-    @CoreMethod(names = "private", rest = true, needsSelf = false, visibility = Visibility.PRIVATE)
+    @CoreMethod(unsafeNeedsAudit = true, names = "private", rest = true, needsSelf = false, visibility = Visibility.PRIVATE)
     public abstract static class PrivateNode extends CoreMethodArrayArgumentsNode {
 
         @Child private ModuleNodes.PrivateNode privateNode;