From: Brian Ford <redmine@...>
Date: 2010-02-04T02:59:40+09:00
Subject: [ruby-core:28036] [Bug #2710] Kernel#load loads a relative path

Bug #2710: Kernel#load loads a relative path
http://redmine.ruby-lang.org/issues/show/2710

Author: Brian Ford
Status: Open, Priority: Normal
Category: core, Target version: 1.9.2
ruby -v: ruby 1.9.2dev (2010-02-03 trunk 26546) [i386-darwin9.8.0]

It was my understanding that Kernel#require was changed to not load a relative path because of a security issue (http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/24155). Does this security issue not apply to Kernel#load, too? Have I misunderstood the expected behavior?

$ cat a.rb 
puts 1

$ cat b.rb 
load 'a.rb'
require 'a.rb'

$ ruby1.8.7 -v b.rb 
ruby 1.8.7 (2009-12-24 patchlevel 248) [i686-darwin9.8.0]
1
1

$ ruby1.9 -v b.rb 
ruby 1.9.2dev (2010-02-03 trunk 26546) [i386-darwin9.8.0]
1
b.rb:2:in `require': no such file to load -- a.rb (LoadError)
        from b.rb:2:in `<main>'

$ RUBYLIB=. ruby1.9 -v b.rb 
ruby 1.9.2dev (2010-02-03 trunk 26546) [i386-darwin9.8.0]
1
1

Thanks,
Brian


----------------------------------------
http://redmine.ruby-lang.org