summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authornagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2013-05-14 11:06:58 +0000
committernagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2013-05-14 11:06:58 +0000
commitc7d7ff45f1e0d6fad28e53c02108d4b067e843c3 (patch)
treed60cb2e9a20860bff7c8acc9422b7f1221b288dc
parent912c16db3dae29fb473152d8861ec7afcf2964b7 (diff)
* ext/dl/lib/dl/func.rb (DL::Function#call): check tainted when
$SAFE > 0. * ext/fiddle/function.c (function_call): check tainted when $SAFE > 0. * test/fiddle/test_func.rb (module Fiddle): add test for above. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@40728 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--ChangeLog8
-rw-r--r--ext/dl/lib/dl/func.rb3
-rw-r--r--ext/fiddle/function.c9
-rw-r--r--test/fiddle/test_func.rb10
4 files changed, 30 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index 85653a5..f78c120 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+Tue May 14 19:58:17 2013 CHIKANAGA Tomoyuki <nagachika@ruby-lang.org>
+
+ * ext/dl/lib/dl/func.rb (DL::Function#call): check tainted when
+ $SAFE > 0.
+ * ext/fiddle/function.c (function_call): check tainted when $SAFE > 0.
+ * test/fiddle/test_func.rb (module Fiddle): add test for above.
+
+
Tue May 14 14:51:52 2013 Nobuyoshi Nakada <nobu@ruby-lang.org>
* include/ruby/win32.h (INTPTR_MAX, INTPTR_MIN, UINTPTR_MAX): split
diff --git a/ext/dl/lib/dl/func.rb b/ext/dl/lib/dl/func.rb
index a2e5038..543711f 100644
--- a/ext/dl/lib/dl/func.rb
+++ b/ext/dl/lib/dl/func.rb
@@ -92,6 +92,9 @@ module DL
super
else
funcs = []
+ if $SAFE >= 1 && args.any? { |x| x.tainted? }
+ raise SecurityError, "tainted parameter not allowed"
+ end
_args = wrap_args(args, @stack.types, funcs, &block)
r = @cfunc.call(@stack.pack(_args))
funcs.each{|f| f.unbind_at_call()}
diff --git a/ext/fiddle/function.c b/ext/fiddle/function.c
index 72a1a62..4a5a589 100644
--- a/ext/fiddle/function.c
+++ b/ext/fiddle/function.c
@@ -126,6 +126,15 @@ function_call(int argc, VALUE argv[], VALUE self)
TypedData_Get_Struct(self, ffi_cif, &function_data_type, cif);
+ if (rb_safe_level() >= 1) {
+ for (i = 0; i < argc; i++) {
+ VALUE src = argv[i];
+ if (OBJ_TAINTED(src)) {
+ rb_raise(rb_eSecurityError, "tainted parameter not allowed");
+ }
+ }
+ }
+
values = xcalloc((size_t)argc + 1, (size_t)sizeof(void *));
generic_args = xcalloc((size_t)argc, (size_t)sizeof(fiddle_generic));
diff --git a/test/fiddle/test_func.rb b/test/fiddle/test_func.rb
index e77229b..92bcd8e 100644
--- a/test/fiddle/test_func.rb
+++ b/test/fiddle/test_func.rb
@@ -7,6 +7,16 @@ module Fiddle
assert_nil f.call(10)
end
+ def test_syscall_with_tainted_string
+ f = Function.new(@libc['system'], [TYPE_VOIDP], TYPE_INT)
+ assert_raises(SecurityError) do
+ Thread.new {
+ $SAFE = 1
+ f.call("uname -rs".taint)
+ }.join
+ end
+ end
+
def test_sinf
begin
f = Function.new(@libm['sinf'], [TYPE_FLOAT], TYPE_FLOAT)