From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS4713 221.184.0.0/13 X-Spam-Status: No, score=-3.3 required=3.0 tests=BAYES_00,DKIM_ADSP_ALL, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, SPF_PASS shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from neon.ruby-lang.org (neon.ruby-lang.org [221.186.184.75]) by dcvr.yhbt.net (Postfix) with ESMTP id 684D41F461 for ; Mon, 13 May 2019 15:07:34 +0000 (UTC) Received: from neon.ruby-lang.org (localhost [IPv6:::1]) by neon.ruby-lang.org (Postfix) with ESMTP id 78D751209AD; Tue, 14 May 2019 00:07:28 +0900 (JST) Authentication-Results: neon.ruby-lang.org; dkim=none reason="no signature"; dkim-adsp=fail (insecure policy); dkim-atps=neutral Received: from o1678916x28.outbound-mail.sendgrid.net (o1678916x28.outbound-mail.sendgrid.net [167.89.16.28]) by neon.ruby-lang.org (Postfix) with ESMTPS id A0980120932 for ; Tue, 14 May 2019 00:07:25 +0900 (JST) Received: by filter0138p3mdw1.sendgrid.net with SMTP id filter0138p3mdw1-6032-5CD9882E-34 2019-05-13 15:07:26.708923729 +0000 UTC m=+335944.479404725 Received: from herokuapp.com (unknown [18.212.173.8]) by ismtpd0049p1mdw1.sendgrid.net (SG) with ESMTP id IFn62mIyTvedFcRYLrnEuw for ; Mon, 13 May 2019 15:07:26.600 +0000 (UTC) Date: Mon, 13 May 2019 15:07:26 +0000 (UTC) From: wolf@wolfsden.cz Message-ID: References: Mime-Version: 1.0 X-Redmine-MailingListIntegration-Message-Ids: 68116 X-Redmine-Project: ruby-trunk X-Redmine-Issue-Id: 15847 X-Redmine-Issue-Author: graywolf X-Redmine-Sender: graywolf X-Mailer: Redmine X-Redmine-Host: bugs.ruby-lang.org X-Redmine-Site: Ruby Issue Tracking System X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-SG-EID: =?us-ascii?Q?PRmwQyJ3VF6bhZU=2FnOofrH9R1JDYhlDzQ7Cyjv1cZudebhYT1DZwVVnWSDCy2w?= =?us-ascii?Q?362YUQR0EVWFUuCtdEyn0AUyjw+V9n2igH27W4o?= =?us-ascii?Q?JUO4RkvVEpL2R13rN2VA0L+0ey826J7VAwPV4r=2F?= =?us-ascii?Q?B48AWsOJF2n1gWL3XbFV5jqW=2Fm6bp5Z+L9Rms=2Fi?= =?us-ascii?Q?eNIyghzrc+GltldWCmpYQoLnQ=2FKw7lvDEnw=3D=3D?= To: ruby-core@ruby-lang.org X-ML-Name: ruby-core X-Mail-Count: 92633 Subject: [ruby-core:92633] [Ruby trunk Bug#15847] SecureRandom#gen_random becomes private after first invocation X-BeenThere: ruby-core@ruby-lang.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Ruby developers List-Id: Ruby developers List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ruby-core-bounces@ruby-lang.org Sender: "ruby-core" Issue #15847 has been reported by graywolf (Gray Wolf). ---------------------------------------- Bug #15847: SecureRandom#gen_random becomes private after first invocation https://bugs.ruby-lang.org/issues/15847 * Author: graywolf (Gray Wolf) * Status: Open * Priority: Normal * Assignee: * Target version: * ruby -v: ruby 2.5.5p157 (2019-03-15 revision 67260) [x86_64-linux] * Backport: 2.4: UNKNOWN, 2.5: UNKNOWN, 2.6: UNKNOWN ---------------------------------------- There seems to be an issue with `SecureRandom#gen_random` becoming private after first invocation: ``` + $ /tmp/my_ruby/bin/ruby -v ruby 2.7.0dev (2019-05-13 trunk 082bbdc92e) [x86_64-linux] ``` ``` $ /tmp/my_ruby/bin/ruby \ -e 'require "securerandom"' \ -e 'SecureRandom.gen_random(1)' $ /tmp/my_ruby/bin/ruby \ -e 'require "securerandom"' \ -e 'SecureRandom.gen_random(1)' \ -e 'SecureRandom.gen_random(1)' Traceback (most recent call last): -e:3:in `
': private method `gen_random' called for SecureRandom:Module (NoMethodError) ``` This is caused by using alias since 2.5 ruby in secure random class. Both `.gen_random_openssl` and `.gen_random_urandom` are private class method. Using the `alias` on them does not remove the private property, so new `.gen_random` is private as well. Patch fixing the issue: ``` diff --git a/lib/securerandom.rb b/lib/securerandom.rb index 37835bf7df..2b0f3753b3 100644 --- a/lib/securerandom.rb +++ b/lib/securerandom.rb @@ -84,7 +84,8 @@ def gen_random(n) @rng_chooser.synchronize do class << self remove_method :gen_random - alias gen_random gen_random_openssl + alias_method(:gen_random, :gen_random_openssl) + public(:gen_random) end end return gen_random(n) @@ -93,7 +94,8 @@ class << self @rng_chooser.synchronize do class << self remove_method :gen_random - alias gen_random gen_random_urandom + alias_method(:gen_random, :gen_random_urandom) + public(:gen_random) end end return gen_random(n) ``` This bug is not present in 2.4.6. First noticed on 2.5.5. Examples in this ticket are from current trunk. -- https://bugs.ruby-lang.org/