From: dan@...
Date: 2010-01-27T18:45:15+09:00
Subject: Re: Best practices when writing destructive code

Marnen Laibow-Koser <marnen@marnen.org> writes:

> Brian Candler wrote:
>> Another hint: use File.expand_path(...) and then check the beginning of 
>> the path matches a particular expression.
>> 
>> target = "/var/tmp/../../etc/passwd"
>> 
>> unless File.expand_path(target).index("/var/tmp/") == 0
>>   raise "You cannot access that file!!"
>
> Reimplement OS permissions in Ruby?  Why?

The obvious reason is to cope with circumstances where you cannot take
good advantage of the OS permissions scheme: e.g. when you do not have
root access.  A "normal" unix user will almsot certainly be able to read
the /etc/passwd file (too much breaks otherwise) and so will any program
they run.


-dan