From: nobuyoshi nakada <nobuyoshi.nakada@...>
Date: 2006-01-18T11:16:14+09:00
Subject: Re: [BUG] Re: 1.8.4 untaint behavior

Hi,

At Wed, 18 Jan 2006 09:11:09 +0900,
Bill Kelly wrote in [ruby-talk:176063]:
> I've reduced it to 10 lines or so, with no external I/O.
> I think this is a bug, unless I'm really doing something dumb.

Probably.

The reason is underlying shared string object still keeps
tainted after the original string got untainted.

This code shows a similar problem.

  line = "x" * 100
  line.taint
  line[0..-1]
  line.untaint
  p line.tainted?, line[0..-1].tainted?


Index: array.c
===================================================================
RCS file: /cvs/ruby/src/ruby/array.c,v
retrieving revision 1.186
diff -U2 -p -r1.186 array.c
--- array.c	12 Dec 2005 16:46:59 -0000	1.186
+++ array.c	18 Jan 2006 02:12:09 -0000
@@ -73,4 +73,12 @@ rb_ary_freeze(VALUE ary)
 }
 
+/* :nodoc: */
+VALUE
+rb_ary_untaint(VALUE ary)
+{
+    rb_ary_modify(ary);
+    return rb_obj_untaint(ary);
+}
+
 /*
  *  call-seq:
@@ -2852,4 +2860,5 @@ Init_Array(void)
     rb_define_method(rb_cArray, "to_ary", rb_ary_to_ary_m, 0);
     rb_define_method(rb_cArray, "frozen?",  rb_ary_frozen_p, 0);
+    rb_define_method(rb_cArray, "untaint",  rb_ary_untaint, 0);
 
     rb_define_method(rb_cArray, "==", rb_ary_equal, 1);
Index: string.c
===================================================================
RCS file: /cvs/ruby/src/ruby/string.c,v
retrieving revision 1.242
diff -U2 -p -r1.242 string.c
--- string.c	29 Dec 2005 17:03:27 -0000	1.242
+++ string.c	18 Jan 2006 02:12:46 -0000
@@ -565,4 +565,12 @@ rb_str_freeze(VALUE str)
 }
 
+/* :nodoc: */
+VALUE
+rb_str_untaint(VALUE str)
+{
+    rb_str_modify(str);
+    return rb_obj_untaint(str);
+}
+
 VALUE
 rb_str_dup_frozen(VALUE str)
@@ -4190,4 +4198,5 @@ Init_String(void)
     rb_define_method(rb_cString, "initialize", rb_str_init, -1);
     rb_define_method(rb_cString, "initialize_copy", rb_str_replace, 1);
+    rb_define_method(rb_cString, "untaint", rb_str_untaint, 0);
     rb_define_method(rb_cString, "<=>", rb_str_cmp_m, 1);
     rb_define_method(rb_cString, "==", rb_str_equal, 1);


-- 
Nobu Nakada