diff options
author | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2011-02-18 12:32:35 +0000 |
---|---|---|
committer | shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2011-02-18 12:32:35 +0000 |
commit | 03022c9d9f686b87d66443eaf38fd7b0e7db5b69 (patch) | |
tree | 4d8b2c6fac744adc97bbf17a8985e38d1302e806 /test | |
parent | 4f4dc7b2afd0cd516836f6dcfa55419cc088b23a (diff) |
merge revision(s) 30903:
* test/ruby/test_exception.rb (TestException::test_to_s_taintness_propagation):
Test for below.
* error.c (exc_to_s): untainted strings can be tainted via
Exception#to_s, which enables attackers to overwrite sane strings.
Reported by: Yusuke Endoh <mame at tsg.ne.jp>.
* error.c (name_err_to_s): ditto.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_7@30911 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'test')
-rw-r--r-- | test/ruby/test_exception.rb | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/test/ruby/test_exception.rb b/test/ruby/test_exception.rb index 4c27c52f3c..c5f409117c 100644 --- a/test/ruby/test_exception.rb +++ b/test/ruby/test_exception.rb @@ -184,4 +184,26 @@ class TestException < Test::Unit::TestCase assert(false) end end + + def test_to_s_taintness_propagation + for exc in [Exception, NameError] + m = "abcdefg" + e = exc.new(m) + e.taint + s = e.to_s + assert_equal(false, m.tainted?, + "#{exc}#to_s should not propagate taintness") + assert_equal(false, s.tainted?, + "#{exc}#to_s should not propagate taintness") + end + + o = Object.new + def o.to_str + "foo" + end + o.taint + e = NameError.new(o) + s = e.to_s + assert_equal(true, s.tainted?) + end end |