From: Brian Candler <b.candler@...>
Date: 2010-01-26T23:26:03+09:00
Subject: Re: Best practices when writing destructive code

Another hint: use File.expand_path(...) and then check the beginning of 
the path matches a particular expression.

target = "/var/tmp/../../etc/passwd"

unless File.expand_path(target).index("/var/tmp/") == 0
  raise "You cannot access that file!!"
end
-- 
Posted via http://www.ruby-forum.com/.