From: takuma ozawa <metal@...>
Date: 2001-12-21T02:05:47+09:00
Subject: [ruby-dev:15508] taint (Regexp.escape and MatchData#to_a)

小澤といいます。

Regexp.escapeとMatchData#to_aで汚染が伝搬しません。
ruby 1.7.2 (2001-12-19) [i586-mswin32]で確認しました。

p Regexp.escape('.*'.taint).tainted?
# => false

/.*/.taint.match('metal').to_a.each { |e| p e.tainted? }
# => false


--- re.c.orig	Tue Dec 11 12:48:08 2001
+++ re.c	Thu Dec 20 01:01:50 2001
@@ -781,11 +781,16 @@
     VALUE ary = rb_ary_new2(regs->num_regs);
     char *ptr = RSTRING(RMATCH(match)->str)->ptr;
     int i;
-
+    int taint = OBJ_TAINTED(match);
+    
     for (i=0; i<regs->num_regs; i++) {
-	if (regs->beg[i] == -1) rb_ary_push(ary, Qnil);
-	else rb_ary_push(ary, rb_str_new(ptr+regs->beg[i],
-					 regs->end[i]-regs->beg[i]));
+	if (regs->beg[i] == -1) {
+	    rb_ary_push(ary, Qnil);
+	} else {
+	    VALUE str = rb_str_new(ptr+regs->beg[i], regs->end[i]-regs->beg[i]);
+	    if (taint) OBJ_TAINT(str);
+	    rb_ary_push(ary, str);
+	}
     }
     return ary;
 }
@@ -1122,7 +1127,7 @@
     }
     kcode_reset_option();
     rb_str_resize(tmp, t - RSTRING(tmp)->ptr);
-
+    OBJ_INFECT(tmp, str);
     return tmp;
 }