Ruby’s Object#send allows access to private methods

by Josh Staiger

lady_liberty01.jpg

The Ruby language (version 1.8.7) allows external access to private methods via the Object#send method. To demonstrate:

class MyClass
    private
    def say_hello(name)
        puts "Hello, #{name}."
    end
end
my_object = MyClass.new
We get smacked if we try: 
> my_object.say_hello
Nomethoderror: private method `say_hello' called for #<MyClass:0x820b4>
	from (irb):8
	from :0
but instead: 
> my_object.send :say_hello, "world"
Hello, world.

The rubydoc for send says nothing of this, and there is some debate on the mailinglist as to whether Ruby 1.9's send will behave this way.

This strikes me as odd. I don’t see why send should function differently from an ordinary method call with respect to access control — but it does.