1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Always mark the string returned by File.realpath as tainted

Browse Source 
This string can include elements that were not in either string
passed to File.realpath, even if one of the strings is an
absolute path, due to symlinks:

```ruby
Dir.mkdir('b') unless File.directory?('b')
File.write('b/a', '') unless File.file?('b/a')
File.symlink('b', 'c') unless File.symlink?('c')
path = File.realpath('c/a'.untaint, Dir.pwd.untaint)
path # "/home/testr/ruby/b/a"
path.tainted? # should be true, as 'b' comes from file system
```

[Bug #15803]
This commit is contained in:
Jeremy Evans 2019-04-27 10:05:26 -07:00 committed by Nobuyoshi Nakada
parent d47cd75b4f
commit a15f7dd1fb
No known key found for this signature in database
GPG Key ID: 4BC7D6DF58D8DF60
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
file.c
View File

@ -4270,7 +4270,7 @@ rb_check_realpath_internal(VALUE basedir, VALUE path, enum rb_realpath_mode mode
}
}
OBJ_INFECT(resolved, unresolved_path);
rb_obj_taint(resolved);
RB_GC_GUARD(unresolved_path);
RB_GC_GUARD(curdir);
return resolved;

2
test/ruby/test_file.rb
View File

@ -298,7 +298,7 @@ class TestFile < Test::Unit::TestCase
assert_predicate(File.realpath(base, dir), :tainted?)
base.untaint
dir.untaint
assert_not_predicate(File.realpath(base, dir), :tainted?)
assert_predicate(File.realpath(base, dir), :tainted?)
assert_predicate(Dir.chdir(dir) {File.realpath(base)}, :tainted?)
}
end