From: merch-redmine@... Date: 2019-07-29T19:18:44+00:00 Subject: [ruby-core:94000] [Ruby master Bug#14485] For File#path.tainted? and File#to_path.tainted? should match original.tainted? Issue #14485 has been updated by jeremyevans0 (Jeremy Evans). Status changed from Closed to Open I had to revert my patch for this because it failed on a lot of operating systems. There must be cases where the file path is tainted on those systems other than the one place where I removed `rb_obj_taint`. Either that, or the new test I wrote for this (which is the only failure), is flawed and needs to be fixed. ---------------------------------------- Bug #14485: For File#path.tainted? and File#to_path.tainted? should match original.tainted? https://bugs.ruby-lang.org/issues/14485#change-80203 * Author: tscheingeld (Terry Scheingeld) * Status: Open * Priority: Normal * Assignee: * Target version: * ruby -v: ruby 2.3.3p222 (2016-11-21) [x86_64-linux-gnu] * Backport: 2.3: UNKNOWN, 2.4: UNKNOWN, 2.5: UNKNOWN ---------------------------------------- Problem: if you create a File object using an untainted path, File#path and File#to_path return identical strings except they are tainted. That's counter-intuitive. If the input path has been properly vetted then File should not taint it. Here's a simple example which produces a security violation: #!/usr/bin/ruby -w $SAFE = 1 path = './myfile.txt' file = File.open(path, 'r') File.exist?(file.path) which gives us this error: ./to-path.rb:5:in `exist?': Insecure operation - exist? (SecurityError) from ./to-path.rb:5:in `
' In this example, path isn't tainted because it was created in the program. However, file.path, which is an identical string (i.e. not normalized) is tainted. This issue became a problem in rack/lint. (Not sure how to tell which version.) Lint tries to do some optimizing, but crashes in these lines: if @body.respond_to?(:to_path) assert("The file identified by body.to_path does not exist") { ::File.exist? @body.to_path } end ---Files-------------------------------- file-path-taint.patch (1.9 KB) -- https://bugs.ruby-lang.org/ Unsubscribe: