kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

file.c: infect from arguments

Browse source 
* file.c (rb_check_realpath_internal): infetct the result with
  arguments, no taint if none are tainted and cwd is not used.
  [ruby-core:83583] [Bug #14060]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60599 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2017-11-01 02:22:10 +00:00
parent 76d4fa8d15
commit 2b43825fae
2 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
file.c
View file

@ -4086,7 +4086,7 @@ rb_check_realpath_internal(VALUE basedir, VALUE path, enum rb_realpath_mode mode
} }
} }
OBJ_TAINT(resolved); OBJ_INFECT(resolved, unresolved_path);
RB_GC_GUARD(unresolved_path); RB_GC_GUARD(unresolved_path);
RB_GC_GUARD(curdir); RB_GC_GUARD(curdir);
return resolved; return resolved;

20
test/ruby/test_file.rb
View file

@ -283,6 +283,26 @@ class TestFile < Test::Unit::TestCase
} }
end end
def test_realpath_taintedness
Dir.mktmpdir('rubytest-realpath') {|tmpdir|
dir = File.realpath(tmpdir).untaint
File.write(File.join(dir, base = "test.file"), '')
base.taint
dir.taint
assert_predicate(File.realpath(base, dir), :tainted?)
base.untaint
dir.taint
assert_predicate(File.realpath(base, dir), :tainted?)
base.taint
dir.untaint
assert_predicate(File.realpath(base, dir), :tainted?)
base.untaint
dir.untaint
assert_not_predicate(File.realpath(base, dir), :tainted?)
assert_predicate(Dir.chdir(dir) {File.realpath(base)}, :tainted?)
}
end
def test_realdirpath def test_realdirpath
Dir.mktmpdir('rubytest-realdirpath') {|tmpdir| Dir.mktmpdir('rubytest-realdirpath') {|tmpdir|
realdir = File.realpath(tmpdir) realdir = File.realpath(tmpdir)