From: usa@... Date: 2019-08-26T14:37:52+00:00 Subject: [ruby-core:94565] [Ruby master Bug#15803] File.realpath should always return a tainted string Issue #15803 has been updated by usa (Usaku NAKAMURA). Backport changed from 2.4: REQUIRED, 2.5: REQUIRED, 2.6: DONE to 2.4: REQUIRED, 2.5: DONE, 2.6: DONE ruby_2_5 r67755 merged revision(s) a15f7dd1fb1148c3d586238ee6907875f2e40379. ---------------------------------------- Bug #15803: File.realpath should always return a tainted string https://bugs.ruby-lang.org/issues/15803#change-81021 * Author: jeremyevans0 (Jeremy Evans) * Status: Closed * Priority: Normal * Assignee: * Target version: * ruby -v: ruby 2.7.0dev (2019-04-28 realpath-taint a1b4816759) [x86_64-openbsd] * Backport: 2.4: REQUIRED, 2.5: DONE, 2.6: DONE ---------------------------------------- This string can include elements that were not in either string passed to File.realpath, even if one of the strings is an absolute path, due to symlinks: ```ruby Dir.mkdir('b') unless File.directory?('b') File.write('b/a', '') unless File.file?('b/a') File.symlink('b', 'c') unless File.symlink?('c') path = File.realpath('c/a'.untaint, Dir.pwd.untaint) path # "/home/testr/ruby/b/a" path.tainted? # should be true, as 'b' comes from file system ``` ---Files-------------------------------- realpath-taint.patch (1.65 KB) -- https://bugs.ruby-lang.org/ Unsubscribe: