From: Bill Kelly <billk@...>
Date: 2006-01-18T07:54:09+09:00
Subject: 1.8.4 untaint behavior

Hi,

I have a script running at $SAFE = 1, and after upgrading ruby
from 1.8.2 to 1.8.4 (ruby 1.8.4 (2005-12-24) [i686-linux]),
I started seeing SecurityError exceptions.

By adding printouts to the following code, I verified that
line.untaint is occurring, and line.tainted? is false, but
after the regexp match on line, the addr, port, and nick
fields that come out of $1 $2 $3 are all tainted:

def read_servers_list(filename)
  servers = []
  IO.foreach($servers_list_filename) do |line|
    line.chop!
    line.strip!
    next if line.empty? || line =~ /\A\s*#/
    if line =~ /\A[A-Za-z0-9\s.:-]+\z/
      line.untaint
    else
      logerr("read_servers_list: refusing to untaint #{line.inspect} because of unexpected characters")
      next
    end
    if line =~ /(\w+)\s+([^\s:]+)(?::(\d+))?/
      addr, port, nick = $2, $3 || "27910", $1
      #
      ##
      ###
      ### At this point,
      ### line.tainted?  => false
      ### [addr,port,nick].all? {|o| o.tainted?}  => true
      ### 
      ##
      #
      servers << ServerAddr.new(addr, port, nick)
    else
      logerr("read_servers_list: couldn't parse #{line.inspect}")
    end
  end
  servers
end

Is this a bug?  Not sure why values extracted from an 
untainted object would be re-tainted.  (Or have I made some
crass mistake?  :)


Thanks for your help,

Regards,

Bill