From 321976844ed83520e903a56802f34c6fa45aabfc Mon Sep 17 00:00:00 2001 From: Cody Cutrer Date: Fri, 14 Mar 2025 13:07:15 -0600 Subject: [PATCH] [jrubyscripting] Disallow exec (#18394) If a script (or a library it calls) accidentally calls Process.exec Signed-off-by: Cody Cutrer --- .../JRubyScriptEngineConfiguration.java | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/bundles/org.openhab.automation.jrubyscripting/src/main/java/org/openhab/automation/jrubyscripting/internal/JRubyScriptEngineConfiguration.java b/bundles/org.openhab.automation.jrubyscripting/src/main/java/org/openhab/automation/jrubyscripting/internal/JRubyScriptEngineConfiguration.java index b9d8895644..43ed838303 100644 --- a/bundles/org.openhab.automation.jrubyscripting/src/main/java/org/openhab/automation/jrubyscripting/internal/JRubyScriptEngineConfiguration.java +++ b/bundles/org.openhab.automation.jrubyscripting/src/main/java/org/openhab/automation/jrubyscripting/internal/JRubyScriptEngineConfiguration.java @@ -300,6 +300,7 @@ public class JRubyScriptEngineConfiguration { }); configureRubyLib(scriptEngine); + disallowExec(scriptEngine); } /** @@ -322,6 +323,24 @@ public class JRubyScriptEngineConfiguration { } } + private void disallowExec(ScriptEngine engine) { + try { + engine.eval(""" + def Process.exec(*) + raise NotImplementedError, "You cannot call `exec` from within openHAB" + end + + module Kernel + module_function def exec(*) + raise NotImplementedError, "You cannot call `exec` from within openHAB" + end + end + """); + } catch (ScriptException exception) { + logger.warn("Error preventing exec", unwrap(exception)); + } + } + public List getRubyLibPaths() { String rubyLib = get(RUBYLIB_CONFIG_KEY); if (rubyLib.isEmpty()) {