diff options
author | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2012-10-12 08:55:41 +0000 |
---|---|---|
committer | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2012-10-12 08:55:41 +0000 |
commit | 57008f89579d15db842f733db6f7ef8328a051b5 (patch) | |
tree | d6227d6ed34b21a78fc4f4e923411f580837f252 | |
parent | 6ae7a4fcf6040deb5d22238d649e115c0d47fd71 (diff) |
merge revision(s) 37068:
* error.c (exc_to_s, name_err_to_s, name_err_mesg_to_str): do not
taint messages.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@37162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | error.c | 8 | ||||
-rw-r--r-- | test/ruby/test_exception.rb | 50 | ||||
-rw-r--r-- | version.h | 2 |
4 files changed, 57 insertions, 8 deletions
@@ -1,3 +1,8 @@ +Fri Oct 12 17:51:43 2012 Shugo Maeda <shugo@ruby-lang.org> + + * error.c (exc_to_s, name_err_to_s, name_err_mesg_to_str): do not + taint messages. + Fri Oct 12 16:11:23 2012 Nobuyoshi Nakada <nobu@ruby-lang.org> * configure.in (LIBDIR_BASENAME): use configured libdir value to fix @@ -569,7 +569,6 @@ exc_to_s(VALUE exc) if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc)); r = rb_String(mesg); - OBJ_INFECT(r, exc); return r; } @@ -853,11 +852,7 @@ name_err_to_s(VALUE exc) if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc)); StringValue(str); - if (str != mesg) { - rb_iv_set(exc, "mesg", mesg = str); - } - OBJ_INFECT(mesg, exc); - return mesg; + return str; } /* @@ -988,7 +983,6 @@ name_err_mesg_to_str(VALUE obj) args[2] = d; mesg = rb_f_sprintf(NAME_ERR_MESG_COUNT, args); } - OBJ_INFECT(mesg, obj); return mesg; } diff --git a/test/ruby/test_exception.rb b/test/ruby/test_exception.rb index b410b708b5..f4174eee6e 100644 --- a/test/ruby/test_exception.rb +++ b/test/ruby/test_exception.rb @@ -333,4 +333,54 @@ end.join load(t.path) end end + + def test_to_s_taintness_propagation + for exc in [Exception, NameError] + m = "abcdefg" + e = exc.new(m) + e.taint + s = e.to_s + assert_equal(false, m.tainted?, + "#{exc}#to_s should not propagate taintness") + assert_equal(false, s.tainted?, + "#{exc}#to_s should not propagate taintness") + end + + o = Object.new + def o.to_str + "foo" + end + o.taint + e = NameError.new(o) + s = e.to_s + assert_equal(false, s.tainted?) + end + + def test_exception_to_s_should_not_propagate_untrustedness + favorite_lang = "Ruby" + + for exc in [Exception, NameError] + assert_raise(SecurityError) do + lambda { + $SAFE = 4 + exc.new(favorite_lang).to_s + favorite_lang.replace("Python") + }.call + end + end + + assert_raise(SecurityError) do + lambda { + $SAFE = 4 + o = Object.new + o.singleton_class.send(:define_method, :to_str) { + favorite_lang + } + NameError.new(o).to_s + favorite_lang.replace("Python") + }.call + end + + assert_equal("Ruby", favorite_lang) + end end @@ -1,5 +1,5 @@ #define RUBY_VERSION "1.9.3" -#define RUBY_PATCHLEVEL 284 +#define RUBY_PATCHLEVEL 285 #define RUBY_RELEASE_DATE "2012-10-12" #define RUBY_RELEASE_YEAR 2012 |