From b9b4a769f11a95ed7fca70d5f2d0620923b36001 Mon Sep 17 00:00:00 2001
From: shugo <shugo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 24 Aug 2004 05:35:12 +0000
Subject: [PATCH] * lib/cgi/session.rb (CGI::Session::FileStore#initialize):
 untaint   session id after check.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@6813 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ChangeLog          | 5 +++++
 lib/cgi/session.rb | 2 +-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 0074f23487..588506a6f1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Tue Aug 24 14:32:17 2004  Shugo Maeda  <shugo@ruby-lang.org>
+
+	* lib/cgi/session.rb (CGI::Session::FileStore#initialize): untaint
+	  session id after check.
+
 Tue Aug 24 08:57:51 2004  GOTOU Yuuzou  <gotoyuzo@notwork.org>
 
 	* ext/openssl/ossl_x509attr.c (ossl_x509attr_initialize): d2i
diff --git a/lib/cgi/session.rb b/lib/cgi/session.rb
index 0bc10d013f..a5afb7e3e1 100644
--- a/lib/cgi/session.rb
+++ b/lib/cgi/session.rb
@@ -364,7 +364,7 @@ class CGI
 	unless check_id(id)
 	  raise ArgumentError, "session_id `%s' is invalid" % id
 	end
-	@path = dir+"/"+prefix+id
+	@path = dir+"/"+prefix+id.dup.untaint
 	unless File::exist? @path
 	  @hash = {}
 	end