kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

* lib/resolv.rb: untaint strings read from /etc/hosts and

Browse source 
/etc/resolv.conf to prevent SecurityError when $SAFE==1.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@2631 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
shugo 2002-07-11 04:02:08 +00:00
parent daba1fcdc0
commit da72e5a644
2 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
Thu Jul 11 12:59:23 2002 Shugo Maeda <shugo@ruby-lang.org>
* lib/resolv.rb: untaint strings read from /etc/hosts and
/etc/resolv.conf to prevent SecurityError when $SAFE==1.
Tue Jul 9 20:03:55 2002 Keiju Ishitsuka <keiju@ishitsuka.com> Tue Jul 9 20:03:55 2002 Keiju Ishitsuka <keiju@ishitsuka.com>
* irb 0.9 * irb 0.9

6
lib/resolv.rb
View file

@ -284,12 +284,15 @@ class Resolv
line.sub!(/#.*/, '') line.sub!(/#.*/, '')
addr, hostname, *aliases = line.split(/\s+/) addr, hostname, *aliases = line.split(/\s+/)
next unless addr next unless addr
addr.untaint
hostname.untaint
@addr2name[addr] = [] unless @addr2name.include? addr @addr2name[addr] = [] unless @addr2name.include? addr
@addr2name[addr] << hostname @addr2name[addr] << hostname
@addr2name[addr] += aliases @addr2name[addr] += aliases
@name2addr[hostname] = [] unless @name2addr.include? hostname @name2addr[hostname] = [] unless @name2addr.include? hostname
@name2addr[hostname] << addr @name2addr[hostname] << addr
aliases.each {|n| aliases.each {|n|
n.untaint
@name2addr[n] = [] unless @name2addr.include? n @name2addr[n] = [] unless @name2addr.include? n
@name2addr[n] << addr @name2addr[n] << addr
} }
@ -689,6 +692,9 @@ class Resolv
f.each {|line| f.each {|line|
line.sub!(/[#;].*/, '') line.sub!(/[#;].*/, '')
keyword, *args = line.split(/\s+/) keyword, *args = line.split(/\s+/)
args.each { |arg|
arg.untaint
}
next unless keyword next unless keyword
case keyword case keyword
when 'nameserver' when 'nameserver'