1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

[ruby/webrick] Don't check tainting in access log escaping

Browse Source 
Only untaint result on Ruby <2.7, as taint support is deprecated
in Ruby 2.7+ and no longer has an effect.

https://github.com/ruby/webrick/commit/4c430f9410
This commit is contained in:
Jeremy Evans 2019-10-18 11:40:36 -07:00 committed by Hiroshi SHIBATA
parent c28d50a753
commit f126d80b1e
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/webrick/accesslog.rb
View File

@ -149,11 +149,9 @@ module WEBrick
# Escapes control characters in +data+ # Escapes control characters in +data+
def escape(data) def escape(data)
if data.tainted? data = data.gsub(/[[:cntrl:]\\]+/) {$&.dump[1...-1]}
data.gsub(/[[:cntrl:]\\]+/) {$&.dump[1...-1]}.untaint data.untaint if RUBY_VERSION < '2.7'
else data
data
end
end end
end end
end end