dup input string before eval so it can't be modified

CHANGES.md

@@ -1,7 +1,14 @@
+### 0.1.11 2026-01-07
+
+- [#19](https://github.com/square/debug_socket/pull/19)
+  `dup` the `input` before `eval`-ing it so any modifications of `input` do not impact logging.
+  (@nerdrew)
+
 ### 0.1.10 2025-09-05
 
-- #18
-  Use log level `warn` instead of `unknown` for logging the socket path. (@mdayaram)
+- [#18](https://github.com/square/debug_socket/pull/18)
+  Use log level `warn` instead of `unknown` for logging the socket path.
+  (@mdayaram)
 
 ### 0.1.9 2025-04-03
 

Gemfile

@@ -6,9 +6,11 @@ source "https://rubygems.org"
 gemspec
 
 gem "base64"
+gem "irb"
 gem "ostruct"
 gem "pry-byebug"
 gem "rake"
+gem "reline"
 gem "rspec", "~> 3.8"
 gem "rubocop", "1.73.1"
 gem "rubocop-rake"

lib/debug_socket.rb

@@ -11,10 +11,6 @@ module Commands
     # to run.
     def self.isolated_eval(input)
       eval(input) # rubocop:disable Security/Eval
-    # We rescue Exception here because the input could have SyntaxErrors etc.
-    rescue Exception => e # rubocop:disable Lint/RescueException
-      DebugSocket.logger&.error { "debug-socket-error=#{e.inspect} input=#{input.inspect} path=#{@path} backtrace=#{e.backtrace.inspect}" }
-      "#{e.class.name}: #{e.message}\n#{e.backtrace.join("\n")}"
     end
 
     # Print the backtrace for every Thread
@@ -63,7 +59,15 @@ def self.start(path, &block)
         logger&.warn("debug-socket-command=#{input.inspect}")
 
         perform_audit(input, &block) if block
-        socket.puts(Commands.isolated_eval(input))
+        output =
+          begin
+            Commands.isolated_eval(input.dup)
+          # We rescue Exception here because the input could have SyntaxErrors etc.
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            logger&.error { "debug-socket-error=#{e.inspect} input=#{input.inspect} path=#{@path} backtrace=#{e.backtrace.inspect}" }
+            "#{e.class.name}: #{e.message}\n#{e.backtrace.join("\n")}"
+          end
+        socket.puts(output)
 
         errors = 0
       rescue StandardError => e

lib/debug_socket/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DebugSocket
-  VERSION = "0.1.10"
+  VERSION = "0.1.11"
 end

spec/debug_socket_spec.rb

@@ -95,6 +95,15 @@ def write(str, socket_path = path)
       expect(write("server = 1")).to eq("1\n")
     end
 
+    it "does not allow modifying the input" do
+      cmd = <<~RUBY
+        input.define_singleton_method(:inspect) { raise "boom" }
+        raise "foo"
+      RUBY
+      expect(write(cmd)).to include("RuntimeError: foo")
+      expect(log_buffer.string).to include(cmd.inspect)
+    end
+
     it "retries socket errors 10 times then dies" do
       20.times { sleep(0.1) unless File.exist?(path) }