Fixed Insecure Operation in require

Caused by 00cd5d74ce
2019-08-17 08:44:31 +09:00 · 2019-08-17 08:44:31 +09:00 · 7624154595
commit 7624154595
parent e0fc9b7ccd
1 changed files with 1 additions and 1 deletions
--- a/lib/rubygems/core_ext/kernel_require.rb
+++ b/lib/rubygems/core_ext/kernel_require.rb
@ -40,7 +40,7 @@ module Kernel
      rp = nil
      $LOAD_PATH[0...Gem.load_path_insert_index || -1].each do |lp|
        Gem.suffixes.each do |s|
-          full_path = File.expand_path(File.join(lp, "#{path}#{s}"))
+          full_path = File.expand_path(File.join(lp, "#{path}#{s}").untaint)
          if File.file?(full_path)
            rp = full_path
            break