From: ts <decoux@...>
Date: 2001-08-31T21:19:05+09:00
Subject: [ruby-talk:20618] Re: Weird string behaviour, I'm stuck.

>>>>> "E" == Erik Terpstra <recon_nospam@dds.nl> writes:

E> --------------------------------------------------
E> /home/httpd/cgi-bin/index.rb:6:in `initialize': Insecure operation - 
E> initialize (SecurityError)
E> 	from /home/httpd/cgi-bin/index.rb:6:in `new'
E> 	from /home/httpd/cgi-bin/index.rb:6
E> --------------------------------------------------

 If I'm right mod_ruby run with $SAFE = 1. At this level you can't create a
 directory if the variable is tainted.

 All environmental variables are tainted, except for ENV["PATH"]

 ENV["PATH"] is tainted if one directory has a component with the mode 002
 (i.e. others has write permission), or if $SAFE >= 3


Guy Decoux