summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorusa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2012-10-12 08:55:41 +0000
committerusa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2012-10-12 08:55:41 +0000
commit57008f89579d15db842f733db6f7ef8328a051b5 (patch)
treed6227d6ed34b21a78fc4f4e923411f580837f252
parent6ae7a4fcf6040deb5d22238d649e115c0d47fd71 (diff)
merge revision(s) 37068:
* error.c (exc_to_s, name_err_to_s, name_err_mesg_to_str): do not taint messages. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_3@37162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--ChangeLog5
-rw-r--r--error.c8
-rw-r--r--test/ruby/test_exception.rb50
-rw-r--r--version.h2
4 files changed, 57 insertions, 8 deletions
diff --git a/ChangeLog b/ChangeLog
index c116f4a..a93d46b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Fri Oct 12 17:51:43 2012 Shugo Maeda <shugo@ruby-lang.org>
+
+ * error.c (exc_to_s, name_err_to_s, name_err_mesg_to_str): do not
+ taint messages.
+
Fri Oct 12 16:11:23 2012 Nobuyoshi Nakada <nobu@ruby-lang.org>
* configure.in (LIBDIR_BASENAME): use configured libdir value to fix
diff --git a/error.c b/error.c
index 060b82c..2d71ede 100644
--- a/error.c
+++ b/error.c
@@ -569,7 +569,6 @@ exc_to_s(VALUE exc)
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
r = rb_String(mesg);
- OBJ_INFECT(r, exc);
return r;
}
@@ -853,11 +852,7 @@ name_err_to_s(VALUE exc)
if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
StringValue(str);
- if (str != mesg) {
- rb_iv_set(exc, "mesg", mesg = str);
- }
- OBJ_INFECT(mesg, exc);
- return mesg;
+ return str;
}
/*
@@ -988,7 +983,6 @@ name_err_mesg_to_str(VALUE obj)
args[2] = d;
mesg = rb_f_sprintf(NAME_ERR_MESG_COUNT, args);
}
- OBJ_INFECT(mesg, obj);
return mesg;
}
diff --git a/test/ruby/test_exception.rb b/test/ruby/test_exception.rb
index b410b70..f4174ee 100644
--- a/test/ruby/test_exception.rb
+++ b/test/ruby/test_exception.rb
@@ -333,4 +333,54 @@ end.join
load(t.path)
end
end
+
+ def test_to_s_taintness_propagation
+ for exc in [Exception, NameError]
+ m = "abcdefg"
+ e = exc.new(m)
+ e.taint
+ s = e.to_s
+ assert_equal(false, m.tainted?,
+ "#{exc}#to_s should not propagate taintness")
+ assert_equal(false, s.tainted?,
+ "#{exc}#to_s should not propagate taintness")
+ end
+
+ o = Object.new
+ def o.to_str
+ "foo"
+ end
+ o.taint
+ e = NameError.new(o)
+ s = e.to_s
+ assert_equal(false, s.tainted?)
+ end
+
+ def test_exception_to_s_should_not_propagate_untrustedness
+ favorite_lang = "Ruby"
+
+ for exc in [Exception, NameError]
+ assert_raise(SecurityError) do
+ lambda {
+ $SAFE = 4
+ exc.new(favorite_lang).to_s
+ favorite_lang.replace("Python")
+ }.call
+ end
+ end
+
+ assert_raise(SecurityError) do
+ lambda {
+ $SAFE = 4
+ o = Object.new
+ o.singleton_class.send(:define_method, :to_str) {
+ favorite_lang
+ }
+ NameError.new(o).to_s
+ favorite_lang.replace("Python")
+ }.call
+ end
+
+ assert_equal("Ruby", favorite_lang)
+ end
end
diff --git a/version.h b/version.h
index b404e16..dcec0e8 100644
--- a/version.h
+++ b/version.h
@@ -1,5 +1,5 @@
#define RUBY_VERSION "1.9.3"
-#define RUBY_PATCHLEVEL 284
+#define RUBY_PATCHLEVEL 285
#define RUBY_RELEASE_DATE "2012-10-12"
#define RUBY_RELEASE_YEAR 2012