Only allow procs created by Symbol#to_proc to call public methods

Fixes [Bug #18826]

Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>

2 files changed, 28 insertions, 1 deletions

diff --git a/spec/ruby/core/kernel/fixtures/warn_core_method.rb b/spec/ruby/core/kernel/fixtures/warn_core_method.rb
index f5dee6b668..fd82562404 100644
--- a/spec/ruby/core/kernel/fixtures/warn_core_method.rb
+++ b/spec/ruby/core/kernel/fixtures/warn_core_method.rb
@@ -1,6 +1,6 @@
 raise 'should be run without RubyGems' if defined?(Gem)
 
-def deprecated(n=1)
+public def deprecated(n=1)
   # puts nil, caller(0), nil
   warn "use X instead", uplevel: n
 end
diff --git a/spec/ruby/core/symbol/to_proc_spec.rb b/spec/ruby/core/symbol/to_proc_spec.rb
index 47f2a939ab..81939e0046 100644
--- a/spec/ruby/core/symbol/to_proc_spec.rb
+++ b/spec/ruby/core/symbol/to_proc_spec.rb
@@ -46,6 +46,33 @@ describe "Symbol#to_proc" do
     end
   end
 
+  ruby_version_is "3.2" do
+    it "only calls public methods" do
+      body = proc do
+        public def pub; @a << :pub end
+        protected def pro; @a << :pro end
+        private def pri; @a << :pri end
+        attr_reader :a
+      end
+
+      @a = []
+      singleton_class.class_eval(&body)
+      tap(&:pub)
+      proc{tap(&:pro)}.should raise_error(NoMethodError)
+      proc{tap(&:pri)}.should raise_error(NoMethodError)
+      @a.should == [:pub]
+
+      @a = []
+      c = Class.new(&body)
+      o = c.new
+      o.instance_variable_set(:@a, [])
+      o.tap(&:pub)
+      proc{tap(&:pro)}.should raise_error(NoMethodError)
+      proc{o.tap(&:pri)}.should raise_error(NoMethodError)
+      o.a.should == [:pub]
+    end
+  end
+
   it "raises an ArgumentError when calling #call on the Proc without receiver" do
     -> {
       :object_id.to_proc.call