archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-27 06:56:13 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

hash.c: prohibit tainted strings

Browse source 
* hash.c (env_aset, env_has_key, env_assoc, env_has_value),
  (env_rassoc, env_key): prohibit tainted strings if $SAFE is
  non-zero.  [Bug #9976]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@46547 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2014-06-25 01:20:01 +00:00
parent 20014eb3e0
commit 51a1c68bc7
3 changed files with 96 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

81
test/ruby/test_env.rb
View file

@ -426,4 +426,85 @@ class TestEnv < Test::Unit::TestCase
assert_predicate(ENV.fetch(k), :frozen?, "fetch(#{k.dump})")
end
end
def test_taint_aref
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV["FOO".taint]
end.call
end
end
def test_taint_fetch
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV.fetch("FOO".taint)
end.call
end
end
def test_taint_assoc
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV.assoc("FOO".taint)
end.call
end
end
def test_taint_rassoc
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV.rassoc("FOO".taint)
end.call
end
end
def test_taint_key
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV.key("FOO".taint)
end.call
end
end
def test_taint_key_p
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV.key?("FOO".taint)
end.call
end
end
def test_taint_value_p
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV.value?("FOO".taint)
end.call
end
end
def test_taint_aset_value
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV["FOO"] = "BAR".taint
end.call
end
end
def test_taint_aset_key
assert_raise(SecurityError) do
proc do
$SAFE = 2
ENV["FOO".taint] = "BAR"
end.call
end
end
end