* file.c (rb_file_s_unlink): should not allow if $SAFE >= 2.

* object.c (rb_obj_taint): backport from 1.7.

* object.c (rb_obj_untaint): add frozen status check (backport from 1.7).

* ruby.c (proc_options): unexpected SecurityError happens when -T4.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_6@1484 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 10 insertions, 0 deletions

diff --git a/ruby.c b/ruby.c
index 6d53b7fa5c..eac3d8701c 100644
--- a/ruby.c
+++ b/ruby.c
@@ -678,6 +678,11 @@ proc_options(argc, argv)
 	ruby_show_copyright();
     }
 
+    if (rb_safe_level() >= 4) {
+      OBJ_TAINT(rb_argv);
+      OBJ_TAINT(rb_load_path);
+    }
+
     if (!e_script && argc == 0) { /* no more args */
 	if (verbose) exit(0);
 	script = "-";
@@ -723,6 +728,11 @@ proc_options(argc, argv)
 
     process_sflag();
     xflag = 0;
+
+    if (rb_safe_level() >= 4) {
+      FL_UNSET(rb_argv, FL_TAINT);
+      FL_UNSET(rb_load_path, FL_TAINT);
+    }
 }
 
 extern int ruby__end__seen;