From: rasfast@...
Date: 2008-08-27T02:00:38+09:00
Subject: Insecure operation

Hello!

I'm trying to make a CGI script which uses modules from Rails, and
I've got a "Security Error". I have read posts about taint/untaint,
but nothing helps. Could you advice something?

Details:
FreeBSD 6.3-STABLE
Rails 2.1.0
Ruby 1.8.6
Apache 2.2 + mod_ruby (for CGI) + latest Phusion Passenger + latest
Ruby Enterprise (for Rails)

Script:
require 'cgi'
require '../config/environment'
params = CGI::parse( ENV['QUERY_STRING'] ).each{ |key, el| {key =>
el.first} } #I don't know how to get GET vars in another way
seller = ContrSeller.find( :first, :conditions => { :id =>
params['seller_id'], :password => params['pass'] } ) #ContrSeller - is
an existing model

Error:
mod_ruby: error in ruby
mod_ruby: /usr/local/lib/ruby/gems/1.8/gems/activesupport-2.1.0/lib/
active_support/dependencies.rb:169:in `file?': Insecure operation -
file? (SecurityError)

I can put a full error output here, but it's not needed.
I have tried to untaint() params variable and its values, but no
success.