archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-08-15 13:39:04 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

merge revision(s) 37068:

Browse source 
* error.c (exc_to_s, name_err_to_s, name_err_mesg_to_str): do not
	  taint messages.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@37162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
usa 2012-10-12 08:55:41 +00:00
parent 6ae7a4fcf6
commit 57008f8957
4 changed files with 57 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
ChangeLog
View file

@ -1,3 +1,8 @@
Fri Oct 12 17:51:43 2012 Shugo Maeda <shugo@ruby-lang.org>
* error.c (exc_to_s, name_err_to_s, name_err_mesg_to_str): do not
taint messages.
Fri Oct 12 16:11:23 2012 Nobuyoshi Nakada <nobu@ruby-lang.org>
* configure.in (LIBDIR_BASENAME): use configured libdir value to fix

8
error.c
View file

@ -569,7 +569,6 @@ exc_to_s(VALUE exc)
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
r = rb_String(mesg);
OBJ_INFECT(r, exc);
return r;
}
@ -853,11 +852,7 @@ name_err_to_s(VALUE exc)
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
StringValue(str);
if (str != mesg) {
rb_iv_set(exc, "mesg", mesg = str);
}
OBJ_INFECT(mesg, exc);
return mesg;
return str;
}
/*
@ -988,7 +983,6 @@ name_err_mesg_to_str(VALUE obj)
args[2] = d;
mesg = rb_f_sprintf(NAME_ERR_MESG_COUNT, args);
}
OBJ_INFECT(mesg, obj);
return mesg;
}

50
test/ruby/test_exception.rb
View file

@ -333,4 +333,54 @@ end.join
load(t.path)
end
end
def test_to_s_taintness_propagation
for exc in [Exception, NameError]
m = "abcdefg"
e = exc.new(m)
e.taint
s = e.to_s
assert_equal(false, m.tainted?,
"#{exc}#to_s should not propagate taintness")
assert_equal(false, s.tainted?,
"#{exc}#to_s should not propagate taintness")
end
o = Object.new
def o.to_str
"foo"
end
o.taint
e = NameError.new(o)
s = e.to_s
assert_equal(false, s.tainted?)
end
def test_exception_to_s_should_not_propagate_untrustedness
favorite_lang = "Ruby"
for exc in [Exception, NameError]
assert_raise(SecurityError) do
lambda {
$SAFE = 4
exc.new(favorite_lang).to_s
favorite_lang.replace("Python")
}.call
end
end
assert_raise(SecurityError) do
lambda {
$SAFE = 4
o = Object.new
o.singleton_class.send(:define_method, :to_str) {
favorite_lang
}
NameError.new(o).to_s
favorite_lang.replace("Python")
}.call
end
assert_equal("Ruby", favorite_lang)
end
end

2
version.h
View file

@ -1,5 +1,5 @@
#define RUBY_VERSION "1.9.3"
#define RUBY_PATCHLEVEL 284
#define RUBY_PATCHLEVEL 285
#define RUBY_RELEASE_DATE "2012-10-12"
#define RUBY_RELEASE_YEAR 2012