# What does SecurityError actually cover?

**URL:** <https://rubytalk.org/t/what-does-securityerror-actually-cover/5771>\
**Category:** ruby-talk\
**Created:** [25 April 2003 14:40 UTC](https://rubytalk.org/t/what-does-securityerror-actually-cover/5771 "2003-04-25T14:40:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Higle](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@Higle](https://rubytalk.org/u/Higle)\
**Post date:** [25 April 2003 14:40 UTC](https://rubytalk.org/t/what-does-securityerror-actually-cover/5771/1 "2003-04-25T14:40:48Z")

</div>

Noob-ish question: So, what does the exception class SecurityError  
actually cover? I’ve been unable to find (without looking at the Ruby  
source code) a quick and dirty explanation of what kinds of security  
issues are caught by SecurityError. I’ve got the Pragmatic book and  
the Nutshell book, but neither go into any detail about what the class  
catches.

Is there possibly an online resource that I haven’t found that  
explains this?

Thanks,  
Hig

---

<div class="post-metadata">

**Author:** ![ts1](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@ts1](https://rubytalk.org/u/ts1)\
**Post date:** [25 April 2003 14:45 UTC](https://rubytalk.org/t/what-does-securityerror-actually-cover/5771/2 "2003-04-25T14:45:58Z")

</div>

> Is there possibly an online resource that I haven't found that  
> explains this?

Chapter 20 "Locking Ruby in the Safe" (p. 257)

pigeon% ruby -T1 -e 1  
ruby: No -e allowed in tainted mode (SecurityError)  
pigeon%

Guy Decoux

---

<div class="post-metadata">

**Author:** ![Gennady1](https://avatars.discourse-cdn.com/v4/letter/g/a4c791/32.png) [@Gennady1](https://rubytalk.org/u/Gennady1)\
**Post date:** [25 April 2003 14:47 UTC](https://rubytalk.org/t/what-does-securityerror-actually-cover/5771/3 "2003-04-25T14:47:50Z")

</div>

Try to increase Ruby safe level and do something with external resources,  
for example:

$SAFE = 4  
system(“ls”)

You’ll get:  
test.rb:3:in `system’: Insecure operation - system (SecurityError)  
from test.rb:2

Gennady.

> **···**
>
> ----- Original Message -----  
> From: “higle” [higle@hotmail.com](mailto:higle@hotmail.com)  
> Newsgroups: comp.lang.ruby  
> To: “ruby-talk ML” [ruby-talk@ruby-lang.org](mailto:ruby-talk@ruby-lang.org)  
> Sent: Friday, April 25, 2003 7:40 AM  
> Subject: What does SecurityError actually cover?
> 
> > Noob-ish question: So, what does the exception class SecurityError  
> > actually cover? I’ve been unable to find (without looking at the Ruby  
> > source code) a quick and dirty explanation of what kinds of security  
> > issues are caught by SecurityError. I’ve got the Pragmatic book and  
> > the Nutshell book, but neither go into any detail about what the class  
> > catches.
> > 
> > Is there possibly an online resource that I haven’t found that  
> > explains this?
> > 
> > Thanks,  
> > Hig

---

<div class="post-metadata">

**Author:** ![Chris18](https://avatars.discourse-cdn.com/v4/letter/c/e8c25b/32.png) [@Chris18](https://rubytalk.org/u/Chris18)\
**Post date:** [25 April 2003 14:47 UTC](https://rubytalk.org/t/what-does-securityerror-actually-cover/5771/4 "2003-04-25T14:47:54Z")

</div>

Noob-ish question: So, what does the exception class SecurityError  
actually cover?

> **···**
>
> ----- Original Message -----  
> From: “higle” [higle@hotmail.com](mailto:higle@hotmail.com)
> 
> * * *
> 
> I’m not sure if this answers your question, but:
> 
> I think security errors mean you are trying to do something in $SAFE mode of  
> 1 or higher with tainted data.
> 
> Try untainting the data (after _very_ carefully determining that it is safe  
> data) and see if that helps.
> 
> Chris

---

<div class="post-metadata">

**Author:** ![Higle](https://avatars.discourse-cdn.com/v4/letter/h/838e76/32.png) [@Higle](https://rubytalk.org/u/Higle)\
**Post date:** [28 April 2003 20:44 UTC](https://rubytalk.org/t/what-does-securityerror-actually-cover/5771/5 "2003-04-28T20:44:42Z")

</div>

Wow, duh! Yeah, I had the wrong idea of what SecurityError was  
actually doing. I think I’ve got 'er now!

Thanks much,  
Hig