ruby-list

なひです。いつもありがとうございます。

> From: "Minero Aoki" <aamine@loveruby.net>
> Sent: Wednesday, December 03, 2003 1:01 AM

> [ruby-dev:22013] HTTP_PROXY
> 
>   TANAKA Akira introduced following web page:
> 
>     http://ftp.ics.uci.edu/pub/websoft/libwww-perl/archive/2001h1/0072.html
> 
>   This page describes the security hole about HTTP_PROXY.  HTTP server
>   overwrite CGI programs' HTTP_* environment variables by request
>   headers, HTTP_PROXY is overwritten by Proxy: HTTP header.
>   So HTTP clients can overwrite HTTP_PROXY environment variable.
>   If CGI programs use HTTP library and the library uses HTTP_PROXY,
>   it causes security hole.

holeをcauseというのはどうかなと思いました。
causeならsecurity problem?

>   Akira pointed out some standard libraries uses HTTP_PROXY without
>   checking.  Related libraries are:
> 
>     * open-uri.rb   (maintainer: TANAKA Akira)
>     * SOAP4R        (maintainer: NAKAMURA Hiroshi aka NaHi)
>     * (net/http)    (maintainer: Minero Aoki)
> 
>   Akira (open-uri maintainer) decided to check if the library is
>   used in CGI programs, by referring to REQUEST_METHOD environment
>   variable.
> 
>   NaHi (SOAP4R maintainer) decided to see use_proxy environment
>   variable.  If ENV['use_proxy'] is set, SOAP4R uses HTTP_PROXY.
>   Otherwise it ignores environment variable.

実際にはENV['soap_use_proxy']が'on'のときのみ、ENV['http_proxy']や
ENV['no_proxy']などを利用することにしました。おそらく次の週では
もう紹介されないと思いますので、そのように変更していただけると
説明の手間が減って助かります。。

>   See each CVS HEAD source code and their rdocs for details.

ちなみにsoap4r, wsdl4r, xsd4rにはrdocはありません。

# 今後付ける気もあまりなかったりして。drb/drb.rbを見て以来、
# これは無茶だと思うようになった。

Thread

Prev Next

In This Thread

Prev Next

[#38851] [soap4r] xmlのcharsetの変更の仕方 — "NAKAMURA, Hiroshi" <nakahiro@...>

[#38853] ruby-dev summary 22012-22103 — Minero Aoki <aamine@...>

[#38858] Object#methods — Tomoyuki Kosimizu <greentea@...2.so-net.ne.jp>

[#38861] Object#singleton_methods — Tomoyuki Kosimizu <greentea@...2.so-net.ne.jp>

[#38863] Module.included — Tomoyuki Kosimizu <greentea@...2.so-net.ne.jp>

[#38868] [ANN] Exerb 3.0.0-preview7 — Yuya Kato <yuya-ml@4th.to>

[#38869] WebUnit — takumi-ruby@...

[#38870] [ANN] rbbr-0.5.0 — Masao Mutoh <mutoh@...>

[#38874] 拡張ライブラリにて、例外の再発生 — Masahiro Kawata <mas@...>

[#38881] ruby-dev summary 22012-22195 — Kazuo Saito <ksaito@...>

[#38883] [cgi.rb] read_multipart でエラー — Kazuhiko <kazuhiko@...>

[#38886] pty problem — OHARA Shigeki <os@...>

[#38889] — lee <lee@...>

[#38890] uconvについて — echizen <echizen@...>

[#38900] rdtoolのインストール — Ryutaro Amano <wn9r-amn@...>

[#38904] setup.rb — rubikitch <rubikitch@...>

[#38905] ext/curses/mouse.rb:23: undefined local variable or method `start_color' — "USUI Makoto" <usui@...>

[#38915] [ANN] rbbr-0.5.1 — Masao Mutoh <mutoh@...>

[#38916] [ANN] Exerb 3.0.0-preview8 — Yuya Kato <yuya-ml@4th.to>

[#38917] rd2 cannot handle filter — rubikitch <rubikitch@...>

[#38919] Ruby 1.8.1 preview4 — matz@... (Yukihiro Matsumoto)

[#38924] [ANN] Exerb 3.0.0-preview9 — Yuya Kato <yuya-ml@4th.to>

[#38925] [ANN] TapKit 0.4.0 — SUZUKI Tetsuya <suzuki@...>

[#38926] Iterated sub! — Takanori Adachi <Taka.Adachi@...>

[#38928] ruby-mode.el の Hash 中でのインデント — KATO Kazuyoshi <kzys@8-p.info>

[#38940] Ruby 1.8.1 preview4 - bccwin32がコンパイルできない — 小西 弘将 <konishih@...6.so-net.ne.jp>

[#38947] BCCWIN32&XPにて、rubyrun.rbの結果 — 竹花 文士 <ruby.mito@...>

[#38961] operator precedence — Kenta MURATA <muraken2@...>

[#38981] — ABE Shigeru <shiger-a@...>

[#38985] ruby 1.8.1 — matz@... (Yukihiro Matsumoto)

[#38986] [ANN] MoBo (ももんが家計簿) 0.3 リリース — Kazuhiko <kazuhiko@...>

[#38987] symbolの展開 — hirocy <hirocy@...>

[#38990] [ANN] Exerb 3.0.0 — Yuya Kato <yuya-ml@4th.to>

[#38992] 1.8.1のWin XP&BCC32 runner.rb結果 — 竹花 文士 <ruby.mito@...>

[#38993] RubyEB が ruby-1.8.1 で SEGV — Kazuhiko <kazuhiko@...>

[#39006] （無題） — 藤田瑞生 <m.fujita@...>

[#39009] (DOSISH?) ext/* インストール不具合 — "Kita." <tko-k@...>

[#39010] Net::HTTP.head に空の文字列を渡したときの処理 — Narushima Hironori <hironori@...>

[#39013] Re: Welcome to our (ruby mailing list) You are added automatically — "王 松林" <wang-songlin@...>

[#39014] lib/debug.rb: incomplete regexp? — "Shirai,Kaoru" <shirai@...>

[ruby-list:38856] Re: ruby-dev summary 22012-22103

Thread

In This Thread

[#38940] Ruby 1.8.1 preview4 - bccwin32がコンパイルできない — 小西弘将 <konishih@...6.so-net.ne.jp>

[#38947] BCCWIN32&XPにて、rubyrun.rbの結果 — 竹花　文士 <ruby.mito@...>

[#38992] 1.8.1のWin XP&BCC32 runner.rb結果 — 竹花　文士 <ruby.mito@...>

[#39013] Re: Welcome to our (ruby mailing list) You are added automatically — "王　松林" <wang-songlin@...>