[ruby-core:93699] [Ruby master Bug#9588] program name variables tainted
From:
merch-redmine@...
Date:
2019-07-12 02:01:25 UTC
List:
ruby-core #93699
Issue #9588 has been updated by jeremyevans0 (Jeremy Evans).
Backport deleted (1.9.3: UNKNOWN, 2.0.0: UNKNOWN, 2.1: UNKNOWN)
It looks like `$0`, `__FILE__`, and `$PROGRAM_NAME` have been not tainted since 2.1. I'm not sure if this is still considered a bug or not.
----------------------------------------
Bug #9588: program name variables tainted
https://bugs.ruby-lang.org/issues/9588#change-79317
* Author: jrusnack (Jan Rusnacko)
* Status: Open
* Priority: Normal
* Assignee:
* Target version:
* ruby -v: 1.8.7, 1.9.3, 2.0.0
* Backport:
----------------------------------------
I have noticed inconsistency in taint flag of program name:
[jrusnack@dhcp-31-42 ruby-safe]$ cat tainted.rb
#!/usr/bin/env ruby
puts "$0: #{$0}, tainted? #{$0.tainted?}"
puts "__FILE__: #{__FILE__}, tainted? #{__FILE__.tainted?}"
puts "$PROGRAM_NAME: #{$PROGRAM_NAME}, tainted? #{$PROGRAM_NAME.tainted?}"
[jrusnack@dhcp-31-42 ruby-safe]$ rvm use 1.8.7
Using /home/jrusnack/.rvm/gems/ruby-1.8.7-p374
[jrusnack@dhcp-31-42 ruby-safe]$ ./tainted.rb
$0: ./tainted.rb, tainted? true
__FILE__: ./tainted.rb, tainted? false
$PROGRAM_NAME: ./tainted.rb, tainted? true
[jrusnack@dhcp-31-42 ruby-safe]$ rvm use 1.9.3
Using /home/jrusnack/.rvm/gems/ruby-1.9.3-p484
[jrusnack@dhcp-31-42 ruby-safe]$ ./tainted.rb
$0: ./tainted.rb, tainted? false
__FILE__: ./tainted.rb, tainted? true
$PROGRAM_NAME: ./tainted.rb, tainted? false
[jrusnack@dhcp-31-42 ruby-safe]$ rvm use 2.0.0
Using /home/jrusnack/.rvm/gems/ruby-2.0.0-p353
[jrusnack@dhcp-31-42 ruby-safe]$ ./tainted.rb
$0: ./tainted.rb, tainted? false
__FILE__: ./tainted.rb, tainted? true
$PROGRAM_NAME: ./tainted.rb, tainted? false
--
https://bugs.ruby-lang.org/
Unsubscribe: <mailto:ruby-core-request@ruby-lang.org?subject=unsubscribe>
<http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>