Even Expert Rubyists Can be Fooled by Misleading Heredoc Syntax.

What do you expect the following code to produce?

If you’re familiar with Ruby’s Heredoc syntax¬†you’ll recognize this syntax as an easy way to capture a string of arbitrary length, but when you execute the file above, you’ll see the syntax is invalid.

Why is this?

Well, as it turns out, ruby doesn’t see this as a heredoc at all. Instead, it sees it as string.«(EOF) which is invalid because EOF is undefined.

That’s pretty confusing and it’s easy for expert coders to miss in a code review.

Since constants in the global context will evaluate, what if we had another innocent looking file included in the project somewhere?

Sure, that’s a little strange looking, but a file like that isn’t beyond the realm of possibility in a large project. What happens if that file somehow found its way into the project?

Suddenly, the invalid syntax from the first file becomes valid with a new and very dangerous meaning. This is subtle enough that it could present a real threat against your projects, especially if its a large project in constant flux.

Keep your eyes peeled for things like this. This one would be very easy to overlook.