kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

* error.c (exc_to_s): untainted strings can be tainted via

Browse source 
Exception#to_s, which enables attackers to overwrite sane strings.
  Reported by: Yusuke Endoh <mame at tsg.ne.jp>.

* error.c (name_err_to_s): ditto.

* test/ruby/test_exception.rb (TestException::test_to_s_taintness_propagation):
  Test for it.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@30903 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
shyouhei 2011-02-18 11:05:02 +00:00
parent 0d672545f1
commit fca16b0c57
3 changed files with 37 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
ChangeLog
View file

@ -1,3 +1,16 @@
Fri Feb 18 20:02:29 2011 Shugo Maeda <shugo@ruby-lang.org>
* test/ruby/test_exception.rb (TestException::test_to_s_taintness_propagation):
Test for below.
Fri Feb 18 19:58:34 2011 URABE Shyouhei <shyouhei@ruby-lang.org>
* error.c (exc_to_s): untainted strings can be tainted via
Exception#to_s, which enables attackers to overwrite sane strings.
Reported by: Yusuke Endoh <mame at tsg.ne.jp>.
* error.c (name_err_to_s): ditto.
Wed Jan 19 17:38:03 2011 NAKAMURA Usaku <usa@ruby-lang.org> Wed Jan 19 17:38:03 2011 NAKAMURA Usaku <usa@ruby-lang.org>
* win32/win32.c (init_stdhandle): backport mistake of r29382. * win32/win32.c (init_stdhandle): backport mistake of r29382.

6
error.c
View file

@ -403,7 +403,6 @@ exc_to_s(exc)
VALUE mesg = rb_attr_get(exc, rb_intern("mesg")); VALUE mesg = rb_attr_get(exc, rb_intern("mesg"));
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc)); if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
if (OBJ_TAINTED(exc)) OBJ_TAINT(mesg);
return mesg; return mesg;
} }
@ -667,10 +666,9 @@ name_err_to_s(exc)
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc)); if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
StringValue(str); StringValue(str);
if (str != mesg) { if (str != mesg) {
rb_iv_set(exc, "mesg", mesg = str); OBJ_INFECT(str, mesg);
} }
if (OBJ_TAINTED(exc)) OBJ_TAINT(mesg); return str;
return mesg;
} }
/* /*

22
test/ruby/test_exception.rb
View file

@ -184,4 +184,26 @@ class TestException < Test::Unit::TestCase
assert(false) assert(false)
end end
end end
def test_to_s_taintness_propagation
for exc in [Exception, NameError]
m = "abcdefg"
e = exc.new(m)
e.taint
s = e.to_s
assert_equal(false, m.tainted?,
"#{exc}#to_s should not propagate taintness")
assert_equal(false, s.tainted?,
"#{exc}#to_s should not propagate taintness")
end
o = Object.new
def o.to_str
"foo"
end
o.taint
e = NameError.new(o)
s = e.to_s
assert_equal(true, s.tainted?)
end
end end