# \[Bug #884\] Insecure operation: -r

**URL:** <https://www.ruby-forum.com/t/bug-884-insecure-operation-r/155663>\
**Category:** Development\
**Created:** [December 15, 2008, 12:06pm UTC](https://www.ruby-forum.com/t/bug-884-insecure-operation-r/155663 "2008-12-15T12:06:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/77aa72/32.png) [@Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/u/Kazuhiro_NISHIYAMA)\
**Post date:** [December 15, 2008, 12:06pm UTC](https://www.ruby-forum.com/t/bug-884-insecure-operation-r/155663/1 "2008-12-15T12:06:50Z")

</div>

Bug #884: Insecure operation: -r  
[http://redmine.ruby-lang.org/issues/show/884](http://redmine.ruby-lang.org/issues/show/884)

e$B5/I\<\<Te(B: Kazuhiro NISHIYAMA  
e$B%9%F!\<%?%9e(B: Open, e$BM%@hEYe(B: Normal

e$B0J2\<$N$h$&$K$9$k$H%(%i!\<%a%C%;!\<%8$NCf$KFf$Ne(B-re$B$,=P$F$-$^$9!#e(B

% ruby-trunk -ve ‘$SAFE=4;open(“”)’  
ruby 1.9.1 (2008-12-14 revision 20736) [i686-linux]  
-e:1:in `open': Insecure operation: -r (SecurityError) from -e:1:in `’  
%

---

<div class="post-metadata">

**Author:** ![Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/77aa72/32.png) [@Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/u/Kazuhiro_NISHIYAMA)\
**Post date:** [December 20, 2008, 2:56pm UTC](https://www.ruby-forum.com/t/bug-884-insecure-operation-r/155663/2 "2008-12-20T14:56:30Z")

</div>

e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B

In message “Re: [ruby-dev:37446] [Bug #884] Insecure operation: -r”  
on Mon, 15 Dec 2008 19:58:41 +0900, Kazuhiro NISHIYAMA  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes:

|e$B0J2\<$N$h$&$K$9$k$H%(%i!\<%a%C%;!\<%8$NCf$KFf$Ne(B-re$B$,=P$F$-$^$9!#e(B  
|  
|% ruby-trunk -ve ‘$SAFE=4;open(“”)’  
|ruby 1.9.1 (2008-12-14 revision 20736) [i686-linux]  
|-e:1:in `open': Insecure operation: -r (SecurityError) | from -e:1:in `’  
|%

e$B%a%=%C%Ie(B(open)e$B$NCf$Ge(Brb\_check\_safe\_obj()e$B$,8F$P$l$F%(%i!\<$K$J$Ce(B  
e$B$?;~!"$=$N%a%=%C%I$,%H%C%W%l%Y%k$G8F$P$l$?\>l9g!“e(B  
rb\_frame\_callee()e$B$,e(BNULLe$B$G$”$k$?$a!"e(B-re$B$GH/@8$7$?%(%i!\<$H4\*0ce(B  
e$B$$$9$k$;$$$N$h$&$G$9!#e(B

rb\_check\_safe\_obj()e$B$G$O!"%H%C%W%l%Y%k$G8F$P$l$?%a%=%C%I$H!“e(B  
e$B\<B9T4D6-$,H/@8$9$kA0e(B(-r)e$B$r6hJL$9$kI,MW$,$”$j$=$&$G$9!#$I$&$d$Ce(B  
e$B$F6hJL$G$-$k$N$+$A$g$C$HD4$Y$F$\_$^$9$M!#e(B

---

<div class="post-metadata">

**Author:** ![Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/77aa72/32.png) [@Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/u/Kazuhiro_NISHIYAMA)\
**Post date:** [December 24, 2008, 4:05pm UTC](https://www.ruby-forum.com/t/bug-884-insecure-operation-r/155663/3 "2008-12-24T16:05:43Z")

</div>

e$B!!$5$5$@$G$9!%e(B

Yukihiro M. wrote::

> rb\_frame\_callee()e$B$,e(BNULLe$B$G$"$k$?$a!"e(B-re$B$GH/@8$7$?%(%i!\<$H4\*0ce(B  
> e$B$$$9$k$;$$$N$h$&$G$9!#e(B
> 
> rb\_check\_safe\_obj()e$B$G$O!"%H%C%W%l%Y%k$G8F$P$l$?%a%=%C%I$H!“e(B  
> e$B\<B9T4D6-$,H/@8$9$kA0e(B(-r)e$B$r6hJL$9$kI,MW$,$”$j$=$&$G$9!#$I$&$d$Ce(B  
> e$B$F6hJL$G$-$k$N$+$A$g$C$HD4$Y$F$\_$^$9$M!#e(B

e$B!!$=$b$=$b!$e(Brb\_frame\_callee() e$B$,e(B caller  
e$B$r8+$k$N$,NI$/$J$$$G$9$M!%e(B  
rb\_f\_method\_name() e$B$NL\>A0$K0z$CD%$i$l$F!$K\Mhe(B rb\_frame\_caller()  
e$B$H$$$C$?e(B  
e$BL\>A0$K$9$k$H$3$m$re(B rb\_frame\_callee()  
e$B$H$$$&L\>A0$K$7$F$$$k$N$,NI$/$J$$!%e(B

e$B!!$H$$$&$o$1$G!$$3$s$J%Q%C%A$r=q$$$F$\_$^$7$?$,$I$&$G$7$g$&$+!%e(B

# Index: eval.c

— eval.c (e$B%j%S%8%g%se(B 20968)  
+++ eval.c (e$B:n6H%3%T!\<e(B)  
@@ -750,6 +750,12 @@ rb\_frame\_this\_func(void)  
ID  
rb\_frame\_callee(void)  
{

- return frame\_func\_id(GET\_THREAD()-\>cfp);  
+}
- 

+static ID  
+rb\_frame\_caller(void)  
+{  
rb\_thread\_t \*th = GET\_THREAD();  
rb\_control\_frame\_t _prev\_cfp =  
RUBY\_VM\_PREVIOUS\_CONTROL\_FRAME(th-\>cfp);  
/_ check if prev\_cfp can be accessible \*/  
@@ -1105,7 +1111,7 @@ rb\_f\_local\_variables(void)  
static VALUE  
rb\_f\_method\_name(void)  
{

- ID fname = rb\_frame\_callee();

- ID fname = rb\_frame\_caller(); /\* need _caller_ ID \*/

---

<div class="post-metadata">

**Author:** ![Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/77aa72/32.png) [@Kazuhiro\_NISHIYAMA](https://www.ruby-forum.com/u/Kazuhiro_NISHIYAMA)\
**Post date:** [December 27, 2008, 8:27am UTC](https://www.ruby-forum.com/t/bug-884-insecure-operation-r/155663/4 "2008-12-27T08:27:29Z")

</div>

e$B%A%1%C%He(B #884 e$B$,99?7$5$l$^$7$?!#e(B (by Koichi Sasada)

e$B%9%F!\<%?%9e(B Opene$B$+$ie(BClosede$B$KJQ99e(B  
e$B?JD=e(B % 0e$B$+$ie(B100e$B$KJQ99e(B

## Applied in changeset r21093.

[http://redmine.ruby-lang.org/issues/show/884](http://redmine.ruby-lang.org/issues/show/884)