ruby 'in' keyword abuse

foo.rb

# hi

# let's imagine we have this kind of structure for a website user. the user can add arbitrary websites,
# which are stored in the userdata[:websites] hash as { :user_selected_name => 'https://example.com' }.

userdata = { 
  username: 'dave',
  websites: {
    homepage: 'https://dave.io',
    twitter: 'https://twitter.com/syn'
  },
  password: 'jampants'
}

# this is currently fine, so we can successfully do

check_password(userdata[:password]) # => check_password('jampants')

# or using the new `in` keyword

in userdata
  check_password(password)
end # => check_password('jampants')

# however what if a user adds a website, and chooses 'password' as its title?

userdata = { 
  username: 'dave',
  websites: {
    homepage: 'https://dave.io',
    twitter: 'https://twitter.com',
    password: 'https://evil.com'
  },
  password: 'jampants'
}

# the old way still works fine

check_password(userdata[:password]) # => check_password('jampants')

# but depending on how it traverses the `userdata` hash, Ruby might encounter the :password key at one of two places

in userdata
  check_password(password)
end # => depending on `in` behaviour, may do check_password('jampants') or check_password('https://evil.com')

# welp.