From 9fbb66610c357cf2396620620f2fa2253939827e Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Fri, 27 Jul 2018 05:42:56 +0000
Subject: ruby.c: taint ARGV on Windows

* ruby.c (external_str_new_cstr): strings come from the external
  should be tainted.  [ruby-dev:50596] [Bug #14941]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@64071 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 ruby.c                        | 4 +++-
 test/ruby/test_rubyoptions.rb | 7 +++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/ruby.c b/ruby.c
index 7e64d081a9..d0f66dcd6d 100644
--- a/ruby.c
+++ b/ruby.c
@@ -2186,7 +2186,9 @@ external_str_new_cstr(const char *p)
 {
 #if UTF8_PATH
     VALUE str = rb_utf8_str_new_cstr(p);
-    return str_conv_enc(str, NULL, rb_default_external_encoding());
+    str = str_conv_enc(str, NULL, rb_default_external_encoding());
+    OBJ_TAINT_RAW(str);
+    return str;
 #else
     return rb_external_str_new_cstr(p);
 #endif
diff --git a/test/ruby/test_rubyoptions.rb b/test/ruby/test_rubyoptions.rb
index 2d50adc9aa..0e6a9b8fe3 100644
--- a/test/ruby/test_rubyoptions.rb
+++ b/test/ruby/test_rubyoptions.rb
@@ -1068,6 +1068,13 @@ class TestRubyOptions < Test::Unit::TestCase
     assert_in_out_err([IO::NULL], success: true)
   end
 
+  def test_argv_tainted
+    assert_separately(%w[- arg], "#{<<~"begin;"}\n#{<<~'end;'}")
+    begin;
+      assert_predicate(ARGV[0], :tainted?, '[ruby-dev:50596] [Bug #14941]')
+    end;
+  end
+
   private
 
   def mjit_force_enabled?
-- 
cgit v1.2.3