From: Hal Brodigan <redmine@...>
Date: 2011-01-16T21:17:19+09:00
Subject: [ruby-core:34520] [Ruby 1.9-Bug#3869] Logger#log does not handle or escape new-line characters.

Issue #3869 has been updated by Hal Brodigan.


NaHi-san, here is the developer warning message:

    **Note**: Logger does not escape or sanitize any messages passed to it. Developers should be aware of when potentially malicious data (user-input) is passed to Logger, and manually escape the untrusted data:

        logger.info("User-input: #{input.dump}")

---
Additional example using the proposed Array convention to escape the untrusted data:
---
        logger.info ["User-input: %p", data]

---
1.9 only example:
---
        logger.info ["User-input: %p{input}", input: data]

----------------------------------------
http://redmine.ruby-lang.org/issues/show/3869

----------------------------------------
http://redmine.ruby-lang.org