parser.rb in safemode-1.3.2

- old
+ new

@@ -83,11 +83,11 @@
                    # :args is now used for block parameters
                    :args,
                    # :colon2 is used for module constants
                    :colon2,
                    # unnecessarily advanced?
-                   :argscat, :argspush, :splat, :block_pass,
+                   :argscat, :argspush, :splat,
                    :op_asgn1, :op_asgn2, :op_asgn_and, :op_asgn_or,
                    # needed for haml
                    :block ]
 
     disallowed = [ # :self,  # self doesn't seem to be needed for vcalls?
@@ -99,10 +99,14 @@
                    :defined, :super, :zsuper, :return,
                    :dmethod, :bmethod, :to_ary, :svalue, :match,
                    :attrasgn, :cdecl, :cvasgn, :cvdecl, :cvar, :gvar, :gasgn,
                    :xstr, :dxstr,
                    # not sure how secure ruby regexp is, so leave it out for now
-                   :dregx, :dregx_once, :match2, :match3, :nth_ref, :back_ref ]
+                   :dregx, :dregx_once, :match2, :match3, :nth_ref, :back_ref,
+                   # block_pass represents &:method, which would bypass the whitelist e.g. by array.each(&:destroy)
+                   # at this point we don't know the receiver so we rather disable it completely,
+                   # use array.each { |item| item.destroy } instead
+                   :block_pass ]
 
     # SexpProcessor bails when we overwrite these ... but they are listed as 
     # "internal nodes that you can't get to" in sexp_processor.rb
     # :ifunc, :method, :last, :opt_n, :cfunc, :newline, :alloca, :memo, :cref
                    