kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

* ext/dl/lib/dl/func.rb (DL::Function#call): check tainted when

Browse source 
$SAFE > 0.
* ext/fiddle/function.c (function_call): check tainted when $SAFE > 0.
* test/fiddle/test_func.rb (module Fiddle): add test for above.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@40728 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nagachika 2013-05-14 11:06:58 +00:00
parent 912c16db3d
commit c7d7ff45f1
4 changed files with 30 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
ChangeLog
View file

@ -1,3 +1,11 @@
Tue May 14 19:58:17 2013 CHIKANAGA Tomoyuki <nagachika@ruby-lang.org>
* ext/dl/lib/dl/func.rb (DL::Function#call): check tainted when
$SAFE > 0.
* ext/fiddle/function.c (function_call): check tainted when $SAFE > 0.
* test/fiddle/test_func.rb (module Fiddle): add test for above.
Tue May 14 14:51:52 2013 Nobuyoshi Nakada <nobu@ruby-lang.org>
* include/ruby/win32.h (INTPTR_MAX, INTPTR_MIN, UINTPTR_MAX): split

3
ext/dl/lib/dl/func.rb
View file

@ -92,6 +92,9 @@ module DL
super
else
funcs = []
if $SAFE >= 1 && args.any? { |x| x.tainted? }
raise SecurityError, "tainted parameter not allowed"
end
_args = wrap_args(args, @stack.types, funcs, &block)
r = @cfunc.call(@stack.pack(_args))
funcs.each{|f| f.unbind_at_call()}

9
ext/fiddle/function.c
View file

@ -126,6 +126,15 @@ function_call(int argc, VALUE argv[], VALUE self)
TypedData_Get_Struct(self, ffi_cif, &function_data_type, cif);
if (rb_safe_level() >= 1) {
for (i = 0; i < argc; i++) {
VALUE src = argv[i];
if (OBJ_TAINTED(src)) {
rb_raise(rb_eSecurityError, "tainted parameter not allowed");
}
}
}
values = xcalloc((size_t)argc + 1, (size_t)sizeof(void *));
generic_args = xcalloc((size_t)argc, (size_t)sizeof(fiddle_generic));

10
test/fiddle/test_func.rb
View file

@ -7,6 +7,16 @@ module Fiddle
assert_nil f.call(10)
end
def test_syscall_with_tainted_string
f = Function.new(@libc['system'], [TYPE_VOIDP], TYPE_INT)
assert_raises(SecurityError) do
Thread.new {
$SAFE = 1
f.call("uname -rs".taint)
}.join
end
end
def test_sinf
begin
f = Function.new(@libm['sinf'], [TYPE_FLOAT], TYPE_FLOAT)