From: Randy Lawrence <jm@...>
Date: 2004-06-22T07:24:33+09:00
Subject: Re: Full-featured untaint() method for Ruby?

Eric Hodel wrote:

> Randy Lawrence (jm@zzzzzzzzzzzz.com) wrote:
> 
> 
>>Hi,
>>
>>I was wondering if there was a full-featured untaint() method available 
>>for Ruby.  We're assuming the built-in untaint() methods simply remove 
>>the flag rather than modify the string.
> 
> 
> Note that any object in ruby can be tainted.  When combined with setting
> $SAFE to a level that always creates tainted objects you can easily
> create a "suspect" object for processing that will be safely handled in
> your application.
> 

We're using a default $SAFE level of 2.

What we'd like to find out is if there is a ruby class or method that 
will fully parse+modify+untaint (rather than simply removing the taint 
flag) of:

1.  strings potentially utilized as part of a shell command
(prevent shell command injection)

2.  strings potentially utilized as part of sql statements
(prevent sql injection)

3.  strings potentially utilized as part of html documents
(prevent cross-site scripting)

and so on...

Surely this functionality is REQUIRED by anyone using ruby to generate 
html or constructing sql statements using any potentially tainted data.

All the productivity gains possible by superior language elegance is 
lost if the wheels have to keep being reinvented.  IMHO, this is a wheel.