kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

rb_str_new_frozen: new object if tainted/untrusted unmatch

Browse source 
* string.c (rb_str_new_frozen): since the result object should have
  same tainted/untrusted bits with the original object, return new
  object if the shared object unmatch.  [ruby-core:39745][Bug #5374]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@36373 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2012-07-12 02:44:27 +00:00
parent 8cc3fef898
commit d744433225
3 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
ChangeLog
View file

@ -1,3 +1,9 @@
Thu Jul 12 11:44:23 2012 Nobuyoshi Nakada <nobu@ruby-lang.org>
* string.c (rb_str_new_frozen): since the result object should have
same tainted/untrusted bits with the original object, return new
object if the shared object unmatch. [ruby-core:39745][Bug #5374]
Thu Jul 12 10:46:39 2012 NAKAMURA Usaku <usa@ruby-lang.org>
* test/net/http/test_http.rb (TestNetHTTPLocalBind#test_bind_to_local*):

2
string.c
View file

@ -681,7 +681,7 @@ rb_str_new_frozen(VALUE orig)
assert(OBJ_FROZEN(str));
ofs = RSTRING_LEN(str) - RSTRING_LEN(orig);
if ((ofs > 0) || (klass != RBASIC(str)->klass) ||
(!OBJ_TAINTED(str) && OBJ_TAINTED(orig)) ||
((RBASIC(str)->flags ^ RBASIC(orig)->flags) & (FL_TAINT|FL_UNTRUSTED)) ||
ENCODING_GET(str) != ENCODING_GET(orig)) {
str = str_new3(klass, str);
RSTRING(str)->as.heap.ptr += ofs;

10
test/ruby/test_file.rb
View file

@ -316,6 +316,16 @@ class TestFile < Test::Unit::TestCase
end
end
def test_untainted_path
bug5374 = '[ruby-core:39745]'
cwd = ("./"*40+".".taint).dup.untaint
in_safe = proc {|safe| $SAFE = safe; File.stat(cwd)}
assert_not_send([cwd, :tainted?])
(0..1).each do |level|
assert_nothing_raised(SecurityError, bug5374) {in_safe[level]}
end
end
if /(bcc|ms|cyg)win|mingw|emx/ =~ RUBY_PLATFORM
def test_long_unc
feature3399 = '[ruby-core:30623]'