-
Notifications
You must be signed in to change notification settings - Fork 46
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Protect against mutating frozen strings #30
Conversation
Also see WinRb/WinRM#221 |
@@ -27,7 +27,7 @@ def self.swap16(str) | |||
# Decode a UTF16 string to a ASCII string | |||
# @param [String] str The string to convert | |||
def self.decode_utf16le(str) | |||
str.force_encoding(Encoding::UTF_16LE) | |||
str.dup.force_encoding(Encoding::UTF_16LE) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Don't we need to do an assignment here? Otherwise the next line will be against the original object?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
ugh. yes of course
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
added reassignment @zenchild
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I tried to find a way to make this blow up if that first encoding was omitted to better catch this in the unit tests but ruby seems very forgiving at least on the strings and encoding I was using
|
Thanks @zenchild ! Will do a release later on. |
I have seen a few occurence where passing in credential strings that are frozen, usually because they are from environment variables, a
can't modify frozen String
error is raised from rubyntlm.In this PR, the altered tests demonstrate this:
This PR duplicates the string in decode to ensure the encoding changes occur on a different instance. For
encode_utf16le
, I simply removed:which seemed unnecesary given that the next line, which already duplicates the value, begins with the same forced encoding.