From: Richard Turner <richard.turner@...>
Date: 2005-04-08T17:43:32+09:00
Subject: Re: Net::SMTP/mod_ruby SecurityError

Hi,

On Fri, 2005-04-08 at 08:48 +0900, Minero Aoki wrote:
> > Unless I'm very much mistaken I've tracked the problem to the
> > send_message() method in smtp.rb. This method calls Array#flatten on its
> > to_addrs parameter which, it seems, causes any elements in that array
> > that had been explicitly untainted to become tainted again. Later, in
> > send0(), a SecurityError is then thrown (if $SAFE > 0) regardless of any
> > programmer's steps to untaint email addresses.
> > 
> > So, my question becomes, is there a way for me to untaint a validated
> > email address and ensure that it stays untainted even when the array
> > it's in is flattened by Net::SMTP.send_message?
> 
> Untaint all addresses explicitly:
> 
>   smtp.send_messages from.untaint, to.map {|a| a.untaint }, str
> 

Ah, I see! Thanks for that. I confess I was quite surprised when I
thought I'd found an error in smtp.rb - it seemed so unlikely - so I'm
glad it was me :)

Cheers,

Richard.