From: shyouhei@...
Date: 2019-05-14T02:50:11+00:00
Subject: [ruby-core:92640] [Ruby trunk Bug#15847] SecureRandom#gen_random becomes private after first invocation

Issue #15847 has been updated by shyouhei (Shyouhei Urabe).


Thank you for reporting!  It was my fault.  have just pushed a fix.

----------------------------------------
Bug #15847: SecureRandom#gen_random becomes private after first invocation
https://bugs.ruby-lang.org/issues/15847#change-78003

* Author: graywolf (Gray Wolf)
* Status: Closed
* Priority: Normal
* Assignee: 
* Target version: 
* ruby -v: ruby 2.5.5p157 (2019-03-15 revision 67260) [x86_64-linux]
* Backport: 2.4: UNKNOWN, 2.5: UNKNOWN, 2.6: UNKNOWN
----------------------------------------
There seems to be an issue with `SecureRandom#gen_random` becoming private after first invocation:

```
+   $ /tmp/my_ruby/bin/ruby -v
ruby 2.7.0dev (2019-05-13 trunk 082bbdc92e) [x86_64-linux]
```

```
$ /tmp/my_ruby/bin/ruby \
	-e 'require "securerandom"' \
	-e 'SecureRandom.gen_random(1)'

$ /tmp/my_ruby/bin/ruby \
	-e 'require "securerandom"' \
	-e 'SecureRandom.gen_random(1)' \
	-e 'SecureRandom.gen_random(1)'
Traceback (most recent call last):
-e:3:in `<main>': private method `gen_random' called for SecureRandom:Module (NoMethodError)
```

This is caused by using alias since 2.5 ruby in secure random class. Both
`.gen_random_openssl` and `.gen_random_urandom` are private class method. Using
the `alias` on them does not remove the private property, so new `.gen_random`
is private as well. Patch fixing the issue:

```
diff --git a/lib/securerandom.rb b/lib/securerandom.rb
index 37835bf7df..2b0f3753b3 100644
--- a/lib/securerandom.rb
+++ b/lib/securerandom.rb
@@ -84,7 +84,8 @@ def gen_random(n)
           @rng_chooser.synchronize do
             class << self
               remove_method :gen_random
-              alias gen_random gen_random_openssl
+              alias_method(:gen_random, :gen_random_openssl)
+              public(:gen_random)
             end
           end
           return gen_random(n)
@@ -93,7 +94,8 @@ class << self
         @rng_chooser.synchronize do
           class << self
             remove_method :gen_random
-            alias gen_random gen_random_urandom
+            alias_method(:gen_random, :gen_random_urandom)
+            public(:gen_random)
           end
         end
         return gen_random(n)
```

This bug is not present in 2.4.6. First noticed on 2.5.5. Examples in this
ticket are from current trunk.




-- 
https://bugs.ruby-lang.org/

Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>