* lib/cgi/session.rb (CGI::Session::FileStore#initialize): untaint

session id after check.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@6813 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,8 @@
+Tue Aug 24 14:32:17 2004  Shugo Maeda  <shugo@ruby-lang.org>
+
+	* lib/cgi/session.rb (CGI::Session::FileStore#initialize): untaint
+	  session id after check.
+
 Tue Aug 24 08:57:51 2004  GOTOU Yuuzou  <gotoyuzo@notwork.org>
 
 	* ext/openssl/ossl_x509attr.c (ossl_x509attr_initialize): d2i

lib/cgi/session.rb

@@ -364,7 +364,7 @@ class CGI
 	unless check_id(id)
 	  raise ArgumentError, "session_id `%s' is invalid" % id
 	end
-	@path = dir+"/"+prefix+id
+	@path = dir+"/"+prefix+id.dup.untaint
 	unless File::exist? @path
 	  @hash = {}
 	end