[#106341] [Ruby master Bug#18369] users.detect(:name, "Dorian") as shorthand for users.detect { |user| user.name == "Dorian" } — dorianmariefr <noreply@...>
Issue #18369 has been reported by dorianmariefr (Dorian Mari辿).
14 messages
2021/11/30
[#106351] [Ruby master Bug#18371] Release branches (release information in general) — "tenderlovemaking (Aaron Patterson)" <noreply@...>
Issue #18371 has been reported by tenderlovemaking (Aaron Patterson).
7 messages
2021/11/30
[ruby-core:106062] [Ruby master Bug#18337] Ruby allows zero-width characters in identifiers
From:
duerst <noreply@...>
Date:
2021-11-15 03:26:26 UTC
List:
ruby-core #106062
Issue #18337 has been updated by duerst (Martin Dテシrst).
The "Trojan source" paper (https://www.trojansource.codes/trojan-source.pdf), in section VII.D, says the following:
"That said, our experimental evidence suggests that this theoretical attack already has defenses employed against it by most modern compilers, and thus is unlikely to work in practice."
My suspicion is that this is because most languages that extend identifier syntax to Unicode do this following Unicodeツョ Standard Annex #31,
Unicode Identifier and Pattern Syntax (https://www.unicode.org/reports/tr31/). Written in Ruby, that document defines identifiers essentially as anything matching `/^\p{id_start}\p{id_continue}*$/`. It shouldn't be too difficult to do that in Ruby.
----------------------------------------
Bug #18337: Ruby allows zero-width characters in identifiers
https://bugs.ruby-lang.org/issues/18337#change-94653
* Author: duerst (Martin Dテシrst)
* Status: Open
* Priority: Normal
* Backport: 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN
----------------------------------------
Ruby allows zero-width characters in identifiers, which can be shown with the following small test:
irb(main):001:0> script = "ab = 20; a\u200Bb = 30; puts ab;"
=> "ab = 20; a窶誼 = 30; puts ab;"
irb(main):002:0> eval(script)
20
=> nil
The first line creates the script. It contains a zero-width space (ZWSP), but that's not visible in most contexts (see next line). Looking at the script, one expects 30 as an output, but the output is 20 because there are two variables involved, one with a ZWSP and one without. I propose we fix this by disallowing such characters in identifiers. I'll give more details in a followup.
--
https://bugs.ruby-lang.org/
Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>