From 2b43825faee0fa69e94dca2aef9d611c602d50c2 Mon Sep 17 00:00:00 2001
From: nobu <nobu@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Wed, 1 Nov 2017 02:22:10 +0000
Subject: [PATCH] file.c: infect from arguments

* file.c (rb_check_realpath_internal): infetct the result with
  arguments, no taint if none are tainted and cwd is not used.
  [ruby-core:83583] [Bug #14060]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60599 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 file.c                 |  2 +-
 test/ruby/test_file.rb | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/file.c b/file.c
index b7569ac75f..843a9796b0 100644
--- a/file.c
+++ b/file.c
@@ -4086,7 +4086,7 @@ rb_check_realpath_internal(VALUE basedir, VALUE path, enum rb_realpath_mode mode
 	}
     }
 
-    OBJ_TAINT(resolved);
+    OBJ_INFECT(resolved, unresolved_path);
     RB_GC_GUARD(unresolved_path);
     RB_GC_GUARD(curdir);
     return resolved;
diff --git a/test/ruby/test_file.rb b/test/ruby/test_file.rb
index 4be4e86131..9d29bbbb65 100644
--- a/test/ruby/test_file.rb
+++ b/test/ruby/test_file.rb
@@ -283,6 +283,26 @@ class TestFile < Test::Unit::TestCase
     }
   end
 
+  def test_realpath_taintedness
+    Dir.mktmpdir('rubytest-realpath') {|tmpdir|
+      dir = File.realpath(tmpdir).untaint
+      File.write(File.join(dir, base = "test.file"), '')
+      base.taint
+      dir.taint
+      assert_predicate(File.realpath(base, dir), :tainted?)
+      base.untaint
+      dir.taint
+      assert_predicate(File.realpath(base, dir), :tainted?)
+      base.taint
+      dir.untaint
+      assert_predicate(File.realpath(base, dir), :tainted?)
+      base.untaint
+      dir.untaint
+      assert_not_predicate(File.realpath(base, dir), :tainted?)
+      assert_predicate(Dir.chdir(dir) {File.realpath(base)}, :tainted?)
+    }
+  end
+
   def test_realdirpath
     Dir.mktmpdir('rubytest-realdirpath') {|tmpdir|
       realdir = File.realpath(tmpdir)