summaryrefslogtreecommitdiff
path: root/lib/cgi
diff options
context:
space:
mode:
authorshugo <shugo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2004-08-24 05:41:07 +0000
committershugo <shugo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2004-08-24 05:41:07 +0000
commit62276d5c1d4c6ab577f57092259d1ff98fa4e79f (patch)
tree5e90eb8d7d6d80d7ee82f2cece2315301e386216 /lib/cgi
parent742483212d0e5930b00d0f6fcf68f5f41d57e3a3 (diff)
* lib/cgi/session.rb (CGI::Session::FileStore#initialize): untaint
session id after check. (backported from HEAD) git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8@6814 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib/cgi')
-rw-r--r--lib/cgi/session.rb2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/cgi/session.rb b/lib/cgi/session.rb
index 0bc10d013f..a5afb7e3e1 100644
--- a/lib/cgi/session.rb
+++ b/lib/cgi/session.rb
@@ -364,7 +364,7 @@ class CGI
unless check_id(id)
raise ArgumentError, "session_id `%s' is invalid" % id
end
- @path = dir+"/"+prefix+id
+ @path = dir+"/"+prefix+id.dup.untaint
unless File::exist? @path
@hash = {}
end