mirror of
https://github.com/ruby/ruby.git
synced 2022-11-09 12:17:21 -05:00
646b83af2a
IO#reopen already takes string path names as well as IO objects (but not "| command" strings) This makes further auditing for inadvertant code execution easier. There's no actual bugfix or behavior change here, as no external data is passed to cgi_runner.rb. * lib/webrick/httpservlet/cgi_runner.rb: remove Kernel#open call [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61398 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
47 lines
993 B
Ruby
47 lines
993 B
Ruby
# frozen_string_literal: false
|
|
#
|
|
# cgi_runner.rb -- CGI launcher.
|
|
#
|
|
# Author: IPR -- Internet Programming with Ruby -- writers
|
|
# Copyright (c) 2000 TAKAHASHI Masayoshi, GOTOU YUUZOU
|
|
# Copyright (c) 2002 Internet Programming with Ruby writers. All rights
|
|
# reserved.
|
|
#
|
|
# $IPR: cgi_runner.rb,v 1.9 2002/09/25 11:33:15 gotoyuzo Exp $
|
|
|
|
def sysread(io, size)
|
|
buf = ""
|
|
while size > 0
|
|
tmp = io.sysread(size)
|
|
buf << tmp
|
|
size -= tmp.bytesize
|
|
end
|
|
return buf
|
|
end
|
|
|
|
STDIN.binmode
|
|
|
|
len = sysread(STDIN, 8).to_i
|
|
out = sysread(STDIN, len)
|
|
STDOUT.reopen(out, "w")
|
|
|
|
len = sysread(STDIN, 8).to_i
|
|
err = sysread(STDIN, len)
|
|
STDERR.reopen(err, "w")
|
|
|
|
len = sysread(STDIN, 8).to_i
|
|
dump = sysread(STDIN, len)
|
|
hash = Marshal.restore(dump)
|
|
ENV.keys.each{|name| ENV.delete(name) }
|
|
hash.each{|k, v| ENV[k] = v if v }
|
|
|
|
dir = File::dirname(ENV["SCRIPT_FILENAME"])
|
|
Dir::chdir dir
|
|
|
|
if ARGV[0]
|
|
argv = ARGV.dup
|
|
argv << ENV["SCRIPT_FILENAME"]
|
|
exec(*argv)
|
|
# NOTREACHED
|
|
end
|
|
exec ENV["SCRIPT_FILENAME"]
|