ruby-dev

こんにちは。

次の点を修正するパッチを書きました。よろしかったら取り入れてください。

　・Session#delete()がエラーになることがある
　・妥当性を確認せずにuntaintするのはどうかと
  ・空のフォームデータでエラーになることがある
　・CGI#[]をもっとシンプルに

read_multipart()は、きちんと書き直したほうがよさそうですが、単にエラー
回避のコードを足しました。

CGI#[]は、変なものを返されたら本当に困ります。

よろしくお願いします。

-- 
HORIKAWA Hisashi (in Kanji: 堀川 久)
Netsphere Laboratories  http://www.nslabs.jp/

Attachments (1)

ruby-1.8.2-20040708-q1.diff (2.68 KB, text/x-diff)

diff -Naur ruby-1.8.2-20040708.orig/lib/cgi/session.rb ruby-1.8.2-20040708-cur/lib/cgi/session.rb
--- ruby-1.8.2-20040708.orig/lib/cgi/session.rb	2004-05-20 13:28:36.000000000 +0900
+++ ruby-1.8.2-20040708-cur/lib/cgi/session.rb	2004-07-10 13:45:45.354286880 +0900
@@ -365,7 +365,6 @@
 	  raise ArgumentError, "session_id `%s' is invalid" % id
 	end
 	@path = dir+"/"+prefix+id
-	@path.untaint
 	unless File::exist? @path
 	  @hash = {}
 	end
@@ -413,7 +412,10 @@
 
       # Close and delete the session's FileStore file.
       def delete
-	File::unlink @path
+        begin
+          File::unlink @path
+        rescue Errno::ENOENT
+        end
       end
     end
 
diff -Naur ruby-1.8.2-20040708.orig/lib/cgi.rb ruby-1.8.2-20040708-cur/lib/cgi.rb
--- ruby-1.8.2-20040708.orig/lib/cgi.rb	2004-05-27 16:50:04.000000000 +0900
+++ ruby-1.8.2-20040708-cur/lib/cgi.rb	2004-07-10 13:42:09.268136968 +0900
@@ -971,11 +971,12 @@
 
       # start multipart/form-data
       stdinput.binmode if defined? stdinput.binmode
-      boundary_size = boundary.size + EOL.size
-      content_length -= boundary_size
-      status = stdinput.read(boundary_size)
+      content_length -= boundary.size + 2
+      status = stdinput.read(boundary.size + 2)
       if nil == status
         raise EOFError, "no content body"
+      elsif status == boundary + "--"
+        return params
       elsif boundary + EOL != status
         raise EOFError, "bad content body"
       end
@@ -1125,37 +1126,12 @@
       @multipart
     end
 
-    class Value < DelegateClass(String)    # :nodoc:
-      def initialize(str, params)
-        @params = params
-        super(str)
-      end
-      def [](idx, *args)
-        if args.size == 0
-          warn "#{caller(1)[0]}:CAUTION! cgi['key'] == cgi.params['key'][0]; if want Array, use cgi.params['key']"
-          self
-        else
-          self.to_s[idx,*args]
-        end
-      end
-      def first
-        warn "#{caller(1)[0]}:CAUTION! cgi['key'] == cgi.params['key'][0]; if want Array, use cgi.params['key']"
-        self
-      end
-      alias last first
-      def to_a
-        @params || [self]
-      end
-      alias to_ary to_a   	# to be rhs of multiple assignment
-    end
-
     # Get the value for the parameter with a given key.
     #
     # If the parameter has multiple values, only the first will be 
     # retrieved; use #params() to get the array of values.
     def [](key)
-      params = @params[key]
-      value = params[0]
+      value = @params[key].first
       if @multipart
         if value
           return value
@@ -1165,7 +1141,7 @@
           Tempfile.new("CGI")
         end
       else
-        Value.new(value || "", params)
+        value || ""
       end
     end

Thread

Prev Next

In This Thread

Prev Next

[#23843] st_dev by stat() != st_dev by fstat() in windows — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#23854] class in singleton class — "NAKAMURA, Hiroshi" <nakahiro@...>

[#23855] Are these comittable? — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#23859] arguments to Thread.start — nobu.nakada@...

[#23864] avalue and break in C block — nobu.nakada@...

[#23871] syntax error — WATANABE Hirofumi <eban@...>

[#23876] cgi, cgi/session — 堀川 久 <vzw00011@...>

[#23883] [bug] strtod(".") should raise ArgumentError — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#23884] Ruby 1.8.2 preview1にむけて — matz@... (Yukihiro Matsumoto)

[#23888] super in Method — nobu.nakada@...

[#23891] openssl test failed — MIYAMUKO Katsuyuki <k-miyamuko@...>

[#23922] ruby 1.8.2 preview1 — matz@... (Yukihiro Matsumoto)

[#23946] [mswin32][ruby1.8.2] $?.pid == 0 — Masahiro Kitajima <katonbo@...>

[#23963] bcc32 {f,fd,fs}open — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#23965] WEBrick::HTTPUtils.escape(" ") — Tanaka Akira <akr@...17n.org>

[#23967] WEBrick::HTTPUtils.escape and URI.escape — Tanaka Akira <akr@...17n.org>

[#23970] ruby_1_8 のバイナリ互換 — "H.Yamamoto" <ocean@...2.ccsnet.ne.jp>

[#23971] typo in inf-ruby.el — Kazuo Saito <ksaito@...>

[#23973] 引数の上書きとsuper — matz@... (Yukihiro Matsumoto)

[#23977] テスト4 — Shugo Maeda <shugo@...>

[#23979] Re: [ruby-cvs] ruby: * eval.c (rb_eval): copy on write for argument local variable — "U.Nakamura" <usa@...>

[#23984] tempfile not removed. — Tanaka Akira <akr@...17n.org>

[#23989] core dump with calling private concat inherited from Array — Tanaka Akira <akr@...17n.org>

[#23991] 1.8.2-preview2? — akira yamada / やまだあきら <akira@...>

[#23995] String#each -> String#each_char — Shugo Maeda <shugo@...>

[#24001] ruby-mode.el のインデント — GOTO Naohisa <ngoto@...>

[#24006] core dump with drb in test — Tanaka Akira <akr@...17n.org>

[ruby-dev:23876] cgi, cgi/session

Attachments (1)

Thread

In This Thread

[#23876] cgi, cgi/session — 堀川久 <vzw00011@...>