From abc40f03ef23ee760046577694b308b08c2f396a Mon Sep 17 00:00:00 2001
From: yugui <yugui@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Sun, 22 Feb 2009 04:30:22 +0000
Subject: merges r21917, r21955 and r21974 from trunk into ruby_1_9_1. * load.c
 (rb_require_safe): raises when the path to be loaded is   tainted. 
 [ruby-dev:37843] --- * file.c (rb_find_file_ext): should not be infected from
 other   load paths. --- * adds a test case for r21955 and r21917.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_1@22500 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 test/ruby/test_require.rb | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

(limited to 'test')

diff --git a/test/ruby/test_require.rb b/test/ruby/test_require.rb
index 4048ba038d..4bc44eff04 100644
--- a/test/ruby/test_require.rb
+++ b/test/ruby/test_require.rb
@@ -195,4 +195,50 @@ class TestRequire < Test::Unit::TestCase
 
     assert_raise(ArgumentError) { at_exit }
   end
+
+  def test_tainted_loadpath
+    t = Tempfile.new(["test_ruby_test_require", ".rb"])
+    abs_dir, file = File.dirname(t.path), File.basename(t.path)
+    abs_dir = File.expand_path(abs_dir).untaint
+
+    assert_in_out_err([], <<-INPUT, %w(:ok), [])
+      abs_dir = "#{ abs_dir }"
+      $: << abs_dir
+      require "#{ file }"
+      p :ok
+    INPUT
+
+    assert_in_out_err([], <<-INPUT, %w(:ok), [])
+      abs_dir = "#{ abs_dir }"
+      $: << abs_dir.taint
+      require "#{ file }"
+      p :ok
+    INPUT
+
+    assert_in_out_err([], <<-INPUT, %w(:ok), [])
+      abs_dir = "#{ abs_dir }"
+      $: << abs_dir.taint
+      $SAFE = 1
+      begin
+        require "#{ file }"
+      rescue SecurityError
+        p :ok
+      end
+    INPUT
+
+    assert_in_out_err([], <<-INPUT, %w(:ok), [])
+      abs_dir = "#{ abs_dir }"
+      $: << abs_dir.taint
+      $SAFE = 1
+      require "#{ t.path }"
+      p :ok
+    INPUT
+
+    assert_in_out_err([], <<-INPUT, %w(:ok), [])
+      abs_dir = "#{ abs_dir }"
+      $: << abs_dir << 'elsewhere'.taint
+      require "#{ file }"
+      p :ok
+    INPUT
+  end
 end
-- 
cgit v1.2.3