From: Eric Hodel <drbrain@...7.net>
Date: 2004-06-22T07:00:15+09:00
Subject: Re: Full-featured untaint() method for Ruby?

--ncSAzJYg3Aa9+CRW
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Randy Lawrence (jm@zzzzzzzzzzzz.com) wrote:

> Hi,
>=20
> I was wondering if there was a full-featured untaint() method available=
=20
> for Ruby.  We're assuming the built-in untaint() methods simply remove=20
> the flag rather than modify the string.

Note that any object in ruby can be tainted.  When combined with setting
$SAFE to a level that always creates tainted objects you can easily
create a "suspect" object for processing that will be safely handled in
your application.

--=20
Eric Hodel - drbrain@segment7.net - http://segment7.net
All messages signed with fingerprint:
FEC2 57F1 D465 EB15 5D6E  7C11 332A 551C 796C 9F04


--ncSAzJYg3Aa9+CRW
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (FreeBSD)

iD8DBQFA11ptMypVHHlsnwQRApuZAKDbj4uFqN+k7lHwQVdjagC4qKMKfwCgmlcd
3WmT+l6h2ZLqzXMzm1pffVE=
=ao3t
-----END PGP SIGNATURE-----

--ncSAzJYg3Aa9+CRW--