Type confusion: Java vs. Ruby

Ruby
1

Preface: this is my first day using Ruby

Today in my computer security class, we talked about Java type confusion
attacks (if you’re unfamiliar, there is a really great article here:
You're Not My Type (Ch. 5, Sec. 7) [Securing Java]).
Basically, when Java references an object, it’s actually using a pointer
to the object in memory, and the pointer has a tag referencing the type
of object it refers to. This type confusion attack is when two pointers
are created to the same object with incompatible types, which confuses
the Java system.

Now, like I said, this is my first day in Ruby. I’ve seen it in scripts,
but very briefly. However, I’m pretty sure that variables in Ruby don’t
have types, but I do know that Ruby uses a dynamic type system for
objects. As far as the language goes, that’s really all I know. I
definitely see some similarities between Ruby and Java, but not enough
to create a stance on this topic.

Our challenge was to find out if type confusion was possible in other
languages, and my group got assigned Ruby. Can anyone offer some insight
or point to some resources?

2

I’m sorry, but I don’t know much about it. In any case, you might find
the
ruby source code useful:

Carlos A.
Control engineering student
Polytechnic School
University of So Paulo

2012/11/6 Regina G. [email protected]

3

By changing the fields of m, the applet can then change the Security Manager,
even though the Security Manager’s fields have been declared private.

class Dog
def initialize
@secret = 10
end
end

d = Dog.new
puts d.instance_eval("@secret")

–output:–
10

d.instance_eval("@secret = 20")
puts d.instance_eval("@secret")

–output:–
20

4

Mm…meaby that’s not what Regina is asking.
Meaby this is the answer you are looking for: the pointer is like a
label, which have a name and it refers to an object located in RAM. The
label has no tag, it’s very simple. You can know the ‘type’ of the
object(which in Ruby is just the class of the object), just pointing to
the object by some label and then passing the message class() to the
reference bringed by that label: the object. This is not hard to
understand, just I’m being recurrent in the same idea.

label = Object.new
label.class() #=> Object

Hope the explanation was helpfull for you. Force be with you.

5

2012/11/7 Regina G. [email protected]:

Our challenge was to find out if type confusion was possible in other
languages, and my group got assigned Ruby. Can anyone offer some insight
or point to some resources?

Every variable in your Ruby code in (internally) a C type called
“VALUE”, which is just a typedefed unsigned int pointer. This pointer
points to a larger structure (in C, RBasic and other structs based on
it, like RString), from which you can read the value’s class and other
properties. (Technically, this works differently for Ruby Fixnums and
Symbols, whose values are magically encoded in the pointer value
itself.)

So it’s not possible to have force this kind of behavior you describe
in Ruby. However, as 7stud pointed out, instance variables (which are
like private fields in Java) can be accessed and modified anyway with
a little magic, and private or protected methods can be with some
tricks called from the outside environment. This is by design, as far
as I know.

– Matma R.

6

Bartosz Dziewoński wrote in post #1083403:

2012/11/7 Regina G. [email protected]:

Our challenge was to find out if type confusion was possible in other
languages, and my group got assigned Ruby. Can anyone offer some insight
or point to some resources?

Every variable in your Ruby code in (internally) a C type called
“VALUE”, which is just a typedefed unsigned int pointer. This pointer
points to a larger structure (in C, RBasic and other structs based on
it, like RString), from which you can read the value’s class and other
properties. (Technically, this works differently for Ruby Fixnums and
Symbols, whose values are magically encoded in the pointer value
itself.)

So it’s not possible to have force this kind of behavior you describe
in Ruby. However, as 7stud pointed out, instance variables (which are
like private fields in Java) can be accessed and modified anyway with
a little magic, and private or protected methods can be with some
tricks called from the outside environment. This is by design, as far
as I know.

– Matma R.

That is really helpful! Thank you! I feel like I understand this a lot
better.

-Regina

7

On Wed, Nov 7, 2012 at 5:12 AM, 7stud – [email protected] wrote:

end
–output:–
20

Since eval is evil there’s also

irb(main):006:0> d=Dog.new
=> #<Dog:0x802e9c64 @secret=10>
irb(main):007:0> d.instance_variable_get ‘@secret’
=> 10
irb(main):008:0> d.instance_variable_set ‘@secret’, 20
=> 20
irb(main):009:0> d.instance_variable_get ‘@secret’
=> 20
irb(main):010:0> d.instance_variables
=> [:@secret]

Kind regards

robert

8

On 8 Nov 2012, at 02:43, Regina G. wrote:

properties. (Technically, this works differently for Ruby Fixnums and
– Matma R.

That is really helpful! Thank you! I feel like I understand this a lot
better.

This is a link to a translation of the Ruby Hacking guide
http://rhg.rubyforge.org/chapter02.html which I got from this also very
useful blog post
Never create Ruby strings longer than 23 characters - Pat Shaughnessy.
There’s lots of good stuff in there about how Ruby stores things.

It may help.

Regards,
Iain