[#56965] [ruby-trunk - Bug #8852][Open] Synology build of ruby-2.0.0-p247 is failing — "barbecuesteve (Steve Sparks)" <sparks@...>

12 messages 2013/09/02

[#57051] [ruby-trunk - Bug #8872][Open] Case statements do not honor a refinement of the '===' method — "jconley88 (Jon Conley)" <schnozberries@...>

21 messages 2013/09/07

[#57058] [ruby-trunk - Bug #8875][Open] Select is not usable with SSLSocket — "headius (Charles Nutter)" <headius@...>

11 messages 2013/09/07

[#57074] [ruby-trunk - Bug #8879][Open] String#to_r fails after moving ruby to other OSX system — "mpapis (Michal Papis)" <mpapis@...>

12 messages 2013/09/08

[#57092] [ruby-trunk - Bug #8883][Open] Rational canonicalization unexpectedly converts to Fixnum — "melquiades (Paul Cantrell)" <cantrell@...>

16 messages 2013/09/09

[#57109] [ruby-trunk - Bug #8886][Open] TracePoint API inconsistence when raise used — deivid (David Rodríguez) <deivid.rodriguez@...>

14 messages 2013/09/10

[#57111] [ruby-trunk - Feature #8887][Open] min(n), max(n), min_by(n), max_by(n) — "akr (Akira Tanaka)" <akr@...>

13 messages 2013/09/10

[#57131] [ruby-trunk - Feature #8895][Open] Destructuring Assignment for Hash — "chendo (Jack Chen)" <ruby-lang@...>

19 messages 2013/09/11

[#57186] [ruby-trunk - Feature #8909][Open] Expand "f" frozen suffix to literal arrays and hashes — "headius (Charles Nutter)" <headius@...>

37 messages 2013/09/14

[#57262] [ruby-trunk - Feature #8921][Open] Allow select, reject, etc to accept a regex — "kyledecot (Kyle Decot)" <kyle.decot@...>

13 messages 2013/09/18

[#57273] [ruby-trunk - Feature #8923][Open] Frozen nil/true/false — "ko1 (Koichi Sasada)" <redmine@...>

13 messages 2013/09/19

[#57353] [ruby-trunk - Feature #8948][Open] Frozen regex — "sawa (Tsuyoshi Sawada)" <sawadatsuyoshi@...>

19 messages 2013/09/24

[#57385] [ruby-trunk - Bug #8953][Open] `str =~ /pattern/` does not call =~ method if (1) str is a String, (2) /pattern/ is a Regexp literal — "gfx (Goro Fuji)" <gfuji@...>

12 messages 2013/09/26

[#57396] [ruby-trunk - Feature #8956][Open] Allow hash members delimited by \n inside of {} — "adamdunson (Adam Dunson)" <adam@...>

20 messages 2013/09/26

[ruby-core:57346] [ruby-trunk - Bug #8945][Open] Unmarshaling an Array containing a Bignum from a tainted String returns a frozen, tainted Bignum

From: "brixen (Brian Shirai)" <brixen@...>
Date: 2013-09-24 04:07:55 UTC
List: ruby-core #57346
Issue #8945 has been reported by brixen (Brian Shirai).

----------------------------------------
Bug #8945: Unmarshaling an Array containing a Bignum from a tainted String returns a frozen, tainted Bignum
https://bugs.ruby-lang.org/issues/8945

Author: brixen (Brian Shirai)
Status: Open
Priority: Normal
Assignee: 
Category: 
Target version: current: 2.1.0
ruby -v: ruby 2.1.0dev (2013-09-24 trunk 43025) [x86_64-darwin13.0.0]
Backport: 1.9.3: UNKNOWN, 2.0.0: UNKNOWN


In 2.1, Symbol, Fixnum, Bignum, and Float (at least) have been changed to frozen by default. Consequently, calling #taint on an instance of those classes raises a RuntimeError because a frozen object cannot be modified to be tainted. However:

sasha:rbx brian$ ruby -v
ruby 2.1.0dev (2013-09-24 trunk 43025) [x86_64-darwin13.0.0]
sasha:rbx brian$ irb
irb(main):001:0> a = 0xffff_ffff_ffff_ffff
=> 18446744073709551615
irb(main):002:0> a.class
=> Bignum
irb(main):003:0> a.frozen?
=> true
irb(main):004:0> a.tainted?
=> false
irb(main):005:0> str = Marshal.dump([a]).taint
=> "\x04\b[\x06l+\t\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF"
irb(main):006:0> str.tainted?
=> true
irb(main):007:0> aa = Marshal.load(str)
=> [18446744073709551615]
irb(main):008:0> aa.first.class
=> Bignum
irb(main):009:0> aa.first.frozen?
=> true
irb(main):010:0> aa.first.tainted?
=> true
irb(main):011:0>

The behavior above is inconsistent with the results of performing the same operations on instances of Symbol, Fixnum, Float. For example:

irb(main):014:0> :a.frozen?
=> true
irb(main):015:0> :a.tainted?
=> false
irb(main):016:0> str = Marshal.dump([:a]).taint
=> "\x04\b[\x06:\x06a"
irb(main):017:0> aa = Marshal.load(str)
=> [:a]
irb(main):018:0> aa.tainted?
=> true
irb(main):019:0> aa.first.frozen?
=> true
irb(main):020:0> aa.first.tainted?
=> false



-- 
http://bugs.ruby-lang.org/

In This Thread

Prev Next