1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

* load.c (rb_require_safe): raises when the path to be loaded is

Browse Source 
tainted.  [ruby-dev:37843]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@21917 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
nobu 2009-01-31 10:07:49 +00:00
parent 62e7e47bdb
commit fa4f685ef7
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -1,3 +1,8 @@
Sat Jan 31 19:09:30 2009 Nobuyoshi Nakada <nobu@ruby-lang.org>
* load.c (rb_require_safe): raises when the path to be loaded is
tainted. [ruby-dev:37843]
Sat Jan 31 18:08:59 2009 Nobuyoshi Nakada <nobu@ruby-lang.org> Sat Jan 31 18:08:59 2009 Nobuyoshi Nakada <nobu@ruby-lang.org>
* configure.in (optflags): defaulted to -O3 to get rid of slug of * configure.in (optflags): defaulted to -O3 to get rid of slug of

6
load.c
View File

@ -554,13 +554,17 @@ rb_require_safe(VALUE fname, int safe)
rb_set_safe_level_force(safe); rb_set_safe_level_force(safe);
FilePathValue(fname); FilePathValue(fname);
RB_GC_GUARD(fname) = rb_str_new4(fname); RB_GC_GUARD(fname) = rb_str_new4(fname);
rb_set_safe_level_force(0);
found = search_required(fname, &path); found = search_required(fname, &path);
if (found) { if (found) {
if (!path || !(ftptr = load_lock(RSTRING_PTR(path)))) { if (!path || !(ftptr = load_lock(RSTRING_PTR(path)))) {
result = Qfalse; result = Qfalse;
} }
else { else {
rb_set_safe_level_force(0); if (safe > 0 && OBJ_TAINTED(path)) {
rb_raise(rb_eSecurityError, "cannot load from insecure path - %s",
RSTRING_PTR(path));
}
switch (found) { switch (found) {
case 'r': case 'r':
rb_load(path, 0); rb_load(path, 0);