From: Yukihiro Matsumoto <matz@...>
Date: 2011-06-09T07:49:06+09:00
Subject: [ruby-core:36866] Re: Object#trust vs Object#taint

Hi,

In message "Re: [ruby-core:36863] Object#trust vs Object#taint"
    on Thu, 9 Jun 2011 06:37:13 +0900, Aaron Patterson <aaron@tenderlovemaking.com> writes:

|What is the difference between tainting and untrusting an object?

Tainting is a mark for data from outside world.  Data from outside
cannot be trusted.  Untrusting is a mark for data from untrusted code
(that run under $SAFE level 4).

|When should library authors taint vs untrust objects?
|When should application authors taint or untrust objects?

Basically you don't have to taint or untrust object explicitly.  Ruby
should mark those flags automatically.  The authors can clear those
flag, but I recommend strict validation before clearing flags.

							matz.