Warn on access/modify of $SAFE, and remove effects of modifying $SAFE

This removes the security features added by $SAFE = 1, and warns for access
or modification of $SAFE from Ruby-level, as well as warning when calling
all public C functions related to $SAFE.

This modifies some internal functions that took a safe level argument
to no longer take the argument.

rb_require_safe now warns, rb_require_string has been added as a
version that takes a VALUE and does not warn.

One public C function that still takes a safe level argument and that
this doesn't warn for is rb_eval_cmd.  We may want to consider
adding an alternative method that does not take a safe level argument,
and warn for rb_eval_cmd.

1 files changed, 13 insertions, 21 deletions

diff --git a/lib/tmpdir.rb b/lib/tmpdir.rb
index d7a8f799fe..ea1d380ef1 100644
--- a/lib/tmpdir.rb
+++ b/lib/tmpdir.rb
@@ -19,22 +19,18 @@ class Dir
   # Returns the operating system's temporary file path.
 
   def self.tmpdir
-    if $SAFE > 0
-      @@systmpdir.dup
-    else
-      tmp = nil
-      [ENV['TMPDIR'], ENV['TMP'], ENV['TEMP'], @@systmpdir, '/tmp', '.'].each do |dir|
-        next if !dir
-        dir = File.expand_path(dir)
-        if stat = File.stat(dir) and stat.directory? and stat.writable? and
-            (!stat.world_writable? or stat.sticky?)
-          tmp = dir
-          break
-        end rescue nil
-      end
-      raise ArgumentError, "could not find a temporary directory" unless tmp
-      tmp
+    tmp = nil
+    [ENV['TMPDIR'], ENV['TMP'], ENV['TEMP'], @@systmpdir, '/tmp', '.'].each do |dir|
+      next if !dir
+      dir = File.expand_path(dir)
+      if stat = File.stat(dir) and stat.directory? and stat.writable? and
+          (!stat.world_writable? or stat.sticky?)
+        tmp = dir
+        break
+      end rescue nil
     end
+    raise ArgumentError, "could not find a temporary directory" unless tmp
+    tmp
   end
 
   # Dir.mktmpdir creates a temporary directory.
@@ -115,12 +111,8 @@ class Dir
     UNUSABLE_CHARS = [File::SEPARATOR, File::ALT_SEPARATOR, File::PATH_SEPARATOR, ":"].uniq.join("").freeze
 
     def create(basename, tmpdir=nil, max_try: nil, **opts)
-      if $SAFE > 0 and tmpdir.tainted?
-        tmpdir = '/tmp'
-      else
-        origdir = tmpdir
-        tmpdir ||= tmpdir()
-      end
+      origdir = tmpdir
+      tmpdir ||= tmpdir()
       n = nil
       prefix, suffix = basename
       prefix = (String.try_convert(prefix) or