diff options
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | error.c | 8 | ||||
-rw-r--r-- | test/ruby/test_exception.rb | 50 | ||||
-rw-r--r-- | version.h | 2 |
4 files changed, 57 insertions, 8 deletions
@@ -1,3 +1,8 @@ +Fri Oct 12 17:51:43 2012 Shugo Maeda <shugo@ruby-lang.org> + + * error.c (exc_to_s, name_err_to_s, name_err_mesg_to_str): do not + taint messages. + Fri Oct 12 16:11:23 2012 Nobuyoshi Nakada <nobu@ruby-lang.org> * configure.in (LIBDIR_BASENAME): use configured libdir value to fix @@ -569,7 +569,6 @@ exc_to_s(VALUE exc) if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc)); r = rb_String(mesg); - OBJ_INFECT(r, exc); return r; } @@ -853,11 +852,7 @@ name_err_to_s(VALUE exc) if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc)); StringValue(str); - if (str != mesg) { - rb_iv_set(exc, "mesg", mesg = str); - } - OBJ_INFECT(mesg, exc); - return mesg; + return str; } /* @@ -988,7 +983,6 @@ name_err_mesg_to_str(VALUE obj) args[2] = d; mesg = rb_f_sprintf(NAME_ERR_MESG_COUNT, args); } - OBJ_INFECT(mesg, obj); return mesg; } diff --git a/test/ruby/test_exception.rb b/test/ruby/test_exception.rb index b410b708b5..f4174eee6e 100644 --- a/test/ruby/test_exception.rb +++ b/test/ruby/test_exception.rb @@ -333,4 +333,54 @@ end.join load(t.path) end end + + def test_to_s_taintness_propagation + for exc in [Exception, NameError] + m = "abcdefg" + e = exc.new(m) + e.taint + s = e.to_s + assert_equal(false, m.tainted?, + "#{exc}#to_s should not propagate taintness") + assert_equal(false, s.tainted?, + "#{exc}#to_s should not propagate taintness") + end + + o = Object.new + def o.to_str + "foo" + end + o.taint + e = NameError.new(o) + s = e.to_s + assert_equal(false, s.tainted?) + end + + def test_exception_to_s_should_not_propagate_untrustedness + favorite_lang = "Ruby" + + for exc in [Exception, NameError] + assert_raise(SecurityError) do + lambda { + $SAFE = 4 + exc.new(favorite_lang).to_s + favorite_lang.replace("Python") + }.call + end + end + + assert_raise(SecurityError) do + lambda { + $SAFE = 4 + o = Object.new + o.singleton_class.send(:define_method, :to_str) { + favorite_lang + } + NameError.new(o).to_s + favorite_lang.replace("Python") + }.call + end + + assert_equal("Ruby", favorite_lang) + end end @@ -1,5 +1,5 @@ #define RUBY_VERSION "1.9.3" -#define RUBY_PATCHLEVEL 284 +#define RUBY_PATCHLEVEL 285 #define RUBY_RELEASE_DATE "2012-10-12" #define RUBY_RELEASE_YEAR 2012 |