зеркало из https://github.com/github/ruby.git
Always mark the string returned by File.realpath as tainted
This string can include elements that were not in either string passed to File.realpath, even if one of the strings is an absolute path, due to symlinks: ```ruby Dir.mkdir('b') unless File.directory?('b') File.write('b/a', '') unless File.file?('b/a') File.symlink('b', 'c') unless File.symlink?('c') path = File.realpath('c/a'.untaint, Dir.pwd.untaint) path # "/home/testr/ruby/b/a" path.tainted? # should be true, as 'b' comes from file system ``` [Bug #15803]
This commit is contained in:
Родитель
d47cd75b4f
Коммит
a15f7dd1fb
2
file.c
2
file.c
|
@ -4270,7 +4270,7 @@ rb_check_realpath_internal(VALUE basedir, VALUE path, enum rb_realpath_mode mode
|
|||
}
|
||||
}
|
||||
|
||||
OBJ_INFECT(resolved, unresolved_path);
|
||||
rb_obj_taint(resolved);
|
||||
RB_GC_GUARD(unresolved_path);
|
||||
RB_GC_GUARD(curdir);
|
||||
return resolved;
|
||||
|
|
|
@ -298,7 +298,7 @@ class TestFile < Test::Unit::TestCase
|
|||
assert_predicate(File.realpath(base, dir), :tainted?)
|
||||
base.untaint
|
||||
dir.untaint
|
||||
assert_not_predicate(File.realpath(base, dir), :tainted?)
|
||||
assert_predicate(File.realpath(base, dir), :tainted?)
|
||||
assert_predicate(Dir.chdir(dir) {File.realpath(base)}, :tainted?)
|
||||
}
|
||||
end
|
||||
|
|
Загрузка…
Ссылка в новой задаче