kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

* eval.c (recursive_push): Taint internal hash to prevent

Browse source 
unexpected SecurityError; fixes #1864.



git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@26277 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
knu 2010-01-10 18:07:50 +00:00
parent 467f377161
commit 386c4b9d00
2 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
Mon Jan 11 03:04:12 2010 Akinori MUSHA <knu@iDaemons.org>
* eval.c (recursive_push): Taint internal hash to prevent
unexpected SecurityError; fixes #1864.
Sun Jan 10 17:25:24 2010 Nobuyoshi Nakada <nobu@ruby-lang.org>
* lib/webrick/accesslog.rb : Escape needed.

2
eval.c
View file

@ -13853,6 +13853,7 @@ recursive_push(hash, obj)
sym = ID2SYM(rb_frame_last_func());
if (NIL_P(hash) || TYPE(hash) != T_HASH) {
hash = rb_hash_new();
OBJ_TAINT(hash);
rb_thread_local_aset(rb_thread_current(), recursive_key, hash);
list = Qnil;
}
@ -13861,6 +13862,7 @@ recursive_push(hash, obj)
}
if (NIL_P(list) || TYPE(list) != T_HASH) {
list = rb_hash_new();
OBJ_TAINT(list);
rb_hash_aset(hash, sym, list);
}
rb_hash_aset(list, obj, Qtrue);